avaya-phone-default-login: Avaya Phone Web Interface - Default Login

id: avaya-phone-default-login

info:
  name: Avaya Phone Web Interface - Default Login
  author: tpierru
  severity: high
  description: |
    Avaya phone web interface contains a default login vulnerability. An attacker can obtain access to sensitive information, modify data, and/or execute unauthorized operations.
  reference:
    - https://documentation.avaya.com/bundle/InstallandadminJ100seriesIPPhone_r4.1.x/page/Logging_into_web_UI.html
  classification:
    cwe-id: CWE-1392
  metadata:
    verified: true
    max-requests: 1
    shodan-query: html:"Avaya J179 Phone"
  tags: default-login,avaya,misconfig

variables:
  username: "admin"
  password: "27238"

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/J100WebServer.cgi?Operation=0"

    extractors:
      - type: kval
        name: nonce
        kval:
          - j100nonce
        internal: true

  - raw:
      - |
        POST /cgi-bin/J100WebServer.cgi?Operation=1 HTTP/1.1
        Host: {{Host}}
        Content-Type: application/x-www-form-urlencoded

        uname={{username}}&psw={{sha256(concat(password,nonce))}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "/cgi-bin/J100WebServer.cgi?Operation=211"
          - "id=\"redirectToDefault"
        condition: or

      - type: word
        part: body
        words:
          - "Invalid username or password"
        negative: true

      - type: status
        status:
          - 200
# digest: 490a00463044022052160b9f254223ce23f031b54483895e9a189cfb7e31d4b0c16a4edb2cea65df022029b40f4ce1e8b27fec261405dfe5545846016b9bb0dc6a4be36e02c1ef3e6535:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.