CVE-2021-43936

🗓️ 06 Dec 2021 17:39:24Reported by icscertType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 132 Views🌐 WEB

The software allows file upload of dangerous types, leading to arbitrary code execution

Reporter	Title	Published	Views	Family All 14
0day.today	WebHMI 4.0 - Remote Code Execution Exploit	13 Dec 202100:00	–	zdt
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Webhmi Webhmi_Firmware	12 Dec 202122:31	–	githubexploit
Circl	CVE-2021-43936	6 Dec 202120:20	–	circl
CNNVD	Distributed Data Systems WebHmi 代码问题漏洞	2 Dec 202100:00	–	cnnvd
CNVD	Distributed Data Systems WebHMI File Upload Vulnerability	4 Dec 202100:00	–	cnvd
Check Point Advisories	Command Injection Over HTTP (CVE-2019-9166; CVE-2021-43936; CVE-2022-1813; CVE-2022-24086; CVE-2022-24193; CVE-2022-26536; CVE-2022-32092; CVE-2022-37810; CVE-2022-40048)	26 Jul 201600:00	–	checkpoint_advisories
Cvelist	CVE-2021-43936 Distributed Data Systems WebHM	6 Dec 202117:39	–	cvelist
Exploit DB	WebHMI 4.0 - Remote Code Execution (RCE) (Authenticated)	13 Dec 202100:00	–	exploitdb
ICS	Distributed Data Systems WebHMI	2 Dec 202100:00	–	ics
NVD	CVE-2021-43936	6 Dec 202118:15	–	nvd

NVD

Vulners

Node

webhmi webhmi_firmwareRange<4.1

AND

webhmi webhmiMatch-

[
  {
    "product": "WebHMI",
    "vendor": "Distributed Data Systems",
    "versions": [
      {
        "lessThan": "4.1",
        "status": "affected",
        "version": "4.1",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
us-cert	www.us-cert.cisa.gov/ics/advisories/icsa-21-336-03
packetstormsecurity	www.packetstormsecurity.com/files/165252/WebHMI-4.0-Remote-Code-Execution.html

Parameter	Position	Path	Description	CWE
X-WH-LOGIN	header	api/signin	Authenticated file upload / code execution flow uses sign-in to obtain session for exploitation	CWE-434
X-WH-PASSWORD	header	api/signin	Authenticated file upload / code execution flow uses sign-in to obtain session for exploitation	CWE-434
sid	query param	login.php?sid={session_id}&uid=1	Login redirection step used in exploit flow to establish session for subsequent actions	CWE-434
uid	query param	login.php?sid={session_id}&uid=1	Login redirection step used in exploit flow to establish session for subsequent actions	CWE-434
file	request body	files.php	Unrestricted file upload leading to remote code execution via uploaded PHP payload	CWE-434
cmd	query param	uploads/files/cmd.php	Executed PHP payload via web-accessible file and command parameter to trigger reverse shell	CWE-434

21 Nov 2024 06:30Current

9.7High risk

Vulners AI Score9.7

CVSS 3.19.8 - 10

CVSS 210

EPSS0.28376

CWE-434