cbcvebase.
CVE-2023-50919
published 2024-01-12

CVE-2023-50919: An issue was discovered on GL.iNet devices before version 4.5.0. There is an NGINX authentication bypass via Lua string pattern matching. This affects A1300…

PriorityP188critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
47.80%
98.7th percentile
An issue was discovered on GL.iNet devices before version 4.5.0. There is an NGINX authentication bypass via Lua string pattern matching. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750 4.3.7, AR300M 4.3.7, and B1300 4.3.7.

Affected

24 ranges
VendorProductVersion rangeFixed in
gl-inetgl-a1300_firmware——
gl-inetgl-a1300_firmware——
gl-inetgl-ar300m_firmware——
gl-inetgl-ar300m_firmware——
gl-inetgl-ar750_firmware——
gl-inetgl-ar750_firmware——
gl-inetgl-ar750s_firmware——
gl-inetgl-ar750s_firmware——
gl-inetgl-ax1800_firmware——
gl-inetgl-ax1800_firmware——
gl-inetgl-axt1800_firmware——
gl-inetgl-axt1800_firmware——
gl-inetgl-b1300_firmware——
gl-inetgl-b1300_firmware——
gl-inetgl-mt1300_firmware——
gl-inetgl-mt1300_firmware——
gl-inetgl-mt2500_firmware——
gl-inetgl-mt2500_firmware——
gl-inetgl-mt3000_firmware——
gl-inetgl-mt3000_firmware——
gl-inetgl-mt300n-v2_firmware——
gl-inetgl-mt300n-v2_firmware——
gl-inetgl-mt6000_firmware——
gl-inetgl-mt6000_firmware——

Detection & IOCsextracted from sources · hover to see the quote

url/rpc
cookieAdmin-Token↗
commandgl_system_log↗
commandgl_crash_log↗
snort
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS GL.iNet Authentication Bypass/SQL Injection attempt (CVE-2023-50919)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/rpc"; http.request_body; content:"|7b 22|jsonrpc|22 3a|"; startswith; content:"|22|2.0|22 2c|"; within:10; content:"|22|id|22 3a|"; within:10; content:"|22|method|22 3a|"; within:30; content:"|22|login|22 2c|"; within:20; content:"|22|params|22 3a|"; within:20; content:"|7b 22|username|22 3a|"; within:30; content:"|22|roo|5b 5e 27|union selecT char|28|114|2c|111|2c|111|2c|116|29 2d 2d 5d 3a|"; fast_pattern; within:100; reference:url,attackerkb.com/topics/LdqSuqHKOj/cve-2023-50919; reference:cve,2023-50919; classtype:attempted-admin; sid:2049926; rev:3; metadata:affected_product GL_iNet, created_at 2024_01_05, cve CVE_2023_50919, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_11_26, reviewed_at 2024_10_03, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
bytes
|7b 22|jsonrpc|22 3a| ... |22|roo|5b 5e 27|union selecT char|28|114|2c|111|2c|111|2c|116|29 2d 2d 5d 3a|
  • →Detect POST requests to /rpc with a JSON body containing 'login' method and a username value matching the SQL injection pattern: roo[^']union selecT char(114,111,111,116)--]:
  • →The bypass chains NGINX authentication bypass (CVE-2023-50919) via Lua string pattern matching with SQL injection to retrieve the Admin-Token/SID without valid credentials, then uses it for RCE via the logread module. ↗
  • →When using Meterpreter payloads against GL.iNet targets, staged payloads may cause core dumps; stageless Meterpreter payloads are used by attackers to avoid detection artifacts from crashes. ↗
  • ·The Snort/Suricata rule (ET sid:2049926) requires SSL/TLS decryption to be effective when traffic is encrypted, as indicated by the deployment metadata.
  • ·MT6000 at version 4.5.0 is listed as vulnerable in the chained RCE advisory but is listed as the fixed version boundary in the NVD entry; verify the exact patched version for MT6000 before excluding it from scope. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.