""ET WEB_SPECIFIC_APPS Ruijie Network Switches Unauthenticated Command Execution""

SID: 2051667

Revision: 1

Class Type: attempted-admin

Metadata: affected_product Ruijie_Network_Products, attack_target Networking_Equipment, tls_state plaintext, created_at 2024_03_15, deployment Perimeter, performance_impact Low, confidence High, signature_severity Major, updated_at 2024_03_15

Reference:

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: $HOME_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "GET"

  • Value: "/EXCU_SHELL"

  • Value: "Cmdnum|3a 20|"

  • Value: "Command1|3a 20|"

  • Value: "Confirm1|3a 20|"

Within:

PCRE: "/^Confirm1\x3a\x20[^\r\n]+[\r\n]+$/Hm"

Special Options:

  • http_method

  • http_uri

  • fast_pattern

  • http_header

  • http_header

  • http_header

source