Increase Coverage of KEV Templates

In this issue, We have compiled a list of KEV CVEs that have publicly available POCs. We are inviting contributions from the community to expand the coverage of Known Exploited Vulnerabilities (KEV) CVEs and make them accessible to everyone.

Expanding the coverage of widely exploited KEV CVEs in the nuclei-templates repository will enhance the detection capabilities and provide more comprehensive security scanning for a broader range of vulnerabilities. This contribution will significantly benefit the entire community by improving the overall effectiveness of vulnerability scanning.

We highly appreciate your involvement and eagerly look forward to your valuable contributions! To contribute, please refer to our Contribution Guide and explore the Nuclei Templates Documentation for further guidance.

If you require any assistance with writing templates or have questions about contributing, feel free to join our Discord server. Our community members will be more than happy to help you.

KEV CVEs

• CVE ID: CVE-2022-41352

  Details

  Description:

  An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavisd via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavisd automatically prefers it over cpio.

  PoC:

  http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html

  Reference:

  https://forums.zimbra.org/viewtopic.php?t=71153&p=306532

• CVE ID: CVE-2022-31460

  Details

  Description:

  Owl Labs Meeting Owl 5.2.0.15 allows attackers to activate Tethering Mode with hard-coded hoothoot credentials via a certain c 150 value.

  PoC:

  https://www.modzero.com/static/meetingowl/Meeting_Owl_Pro_Security_Disclosure_Report_RELEASE.pdf

  Reference:

  https://arstechnica.com/information-technology/2022/06/vulnerabilities-in-meeting-owl-videoconference-device-imperil-100k-users/

• CVE ID: CVE-2022-28958

  Details

  Description:

  ** DISPUTED ** D-Link DIR816L_FW206b01 was discovered to contain a remote code execution (RCE) vulnerability via the value parameter at shareport.php. NOTE: this has been disputed by a third party.

  PoC:

  https://github.com/shijin0925/IOT/blob/master/DIR816/3.md

  Reference:

  https://www.dlink.com/en/security-bulletin/

• CVE ID: CVE-2022-24706

  Details

  Description:

  In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

  PoC:

  http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html

  Reference:

  http://www.openwall.com/lists/oss-security/2022/04/26/1

• CVE ID: CVE-2022-28810

  Details

  Description:

  Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field.

  PoC:

  http://packetstormsecurity.com/files/166816/ManageEngine-ADSelfService-Plus-Custom-Script-Execution.html

  Reference:

  https://www.manageengine.com/products/self-service-password/kb/cve-2022-28810.html

• CVE ID: CVE-2022-26258

  Details

  Description:

  D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp.

  PoC:

  https://github.com/skyedai910/Vuln/tree/master/DIR-820L/command_execution_0

  Reference:

  http://dlink.com

• CVE ID: CVE-2022-26143

  Details

  Description:

  The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in February and March 2022 for the TP240PhoneHome DDoS attack.

  PoC:

  https://arstechnica.com/information-technology/2022/03/ddosers-use-new-method-capable-of-amplifying-traffic-by-a-factor-of-4-billion/

  Reference:

  https://blog.cloudflare.com/cve-2022-26143/

• CVE ID: CVE-2021-45382

  Details

  Description:

  A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file. Note: DIR-810L, DIR-820L, DIR-830L, DIR-826L, DIR-836L, all hardware revisions, have reached their End of Life ("EOL") /End of Service Life ("EOS") Life-Cycle and as such this issue will not be patched.

  PoC:

  https://github.com/doudoudedi/D-LINK_Command_Injection1/blob/main/D-LINK_Command_injection.md

  Reference:

  https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10264

• CVE ID: CVE-2022-24682

  Details

  Description:

  An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

  PoC:

  https://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerability-in-zimbra/

  Reference:

  https://blog.zimbra.com/2022/02/hotfix-available-5-feb-for-zero-day-exploit-vulnerability-in-zimbra-8-8-15/

• CVE ID: CVE-2021-35395

  Details

  Description:

  Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be used to configure the access point. Two versions of this management interface exists: one based on Go-Ahead named webs and another based on Boa named boa. Both of them are affected by these vulnerabilities. Specifically, these binaries are vulnerable to the following issues: - stack buffer overflow in formRebootCheck due to unsafe copy of submit-url parameter - stack buffer overflow in formWsc due to unsafe copy of submit-url parameter - stack buffer overflow in formWlanMultipleAP due to unsafe copy of submit-url parameter - stack buffer overflow in formWlSiteSurvey due to unsafe copy of ifname parameter - stack buffer overflow in formStaticDHCP due to unsafe copy of hostname parameter - stack buffer overflow in formWsc due to unsafe copy of 'peerPin' parameter - arbitrary command execution in formSysCmd via the sysCmd parameter - arbitrary command injection in formWsc via the 'peerPin' parameter Exploitability of identified issues will differ based on what the end vendor/manufacturer did with the Realtek SDK webserver. Some vendors use it as-is, others add their own authentication implementation, some kept all the features from the server, some remove some of them, some inserted their own set of features. However, given that Realtek SDK implementation is full of insecure calls and that developers tends to re-use those examples in their custom code, any binary based on Realtek SDK webserver will probably contains its own set of issues on top of the Realtek ones (if kept). Successful exploitation of these issues allows remote attackers to gain arbitrary code execution on the device.

  PoC:

  https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain

  Reference:

  https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en

• CVE ID: CVE-2021-35394

  Details

  Description:

  Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.

  PoC:

  https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain

  Reference:

  https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en

• CVE ID: CVE-2021-21551

  Details

  Description:

  Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required.

  PoC:

  http://packetstormsecurity.com/files/162604/Dell-DBUtil_2_3.sys-IOCTL-Memory-Read-Write.html

  Reference:

  https://www.dell.com/support/kbdoc/en-us/000186019/dsa-2021-088-dell-client-platform-security-update-for-dell-driver-insufficient-access-control-vulnerability

• CVE ID: CVE-2021-22204

  Details

  Description:

  Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

  PoC:

  http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html

  Reference:

  http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html

• CVE ID: CVE-2021-27878

  Details

  Description:

  An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. The attacker could use one of these commands to execute an arbitrary command on the system using system privileges.

  PoC:

  http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html

  Reference:

  https://www.veritas.com/content/support/en_US/security/VTS21-001#issue3

• CVE ID: CVE-2021-27877

  Details

  Description:

  An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these. This authentication scheme is no longer used in current versions of the product, but hadn't yet been disabled. An attacker could remotely exploit this scheme to gain unauthorized access to an Agent and execute privileged commands.

  PoC:

  http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html

  Reference:

  https://www.veritas.com/content/support/en_US/security/VTS21-001#issue1

• CVE ID: CVE-2021-27876

  Details

  Description:

  An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. By using crafted input parameters in one of these commands, an attacker can access an arbitrary file on the system using System privileges.

  PoC:

  http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html

  Reference:

  https://www.veritas.com/content/support/en_US/security/VTS21-001#issue2

• CVE ID: CVE-2020-28949

  Details

  Description:

  Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.

  PoC:

  http://packetstormsecurity.com/files/161095/PEAR-Archive_Tar-Arbitrary-File-Write.html

  Reference:

  https://lists.debian.org/debian-lts-announce/2020/11/msg00045.html

• CVE ID: CVE-2020-8260

  Details

  Description:

  A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction.

  PoC:

  http://packetstormsecurity.com/files/160619/Pulse-Secure-VPN-Remote-Code-Execution.html

  Reference:

  https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601

• CVE ID: CVE-2020-14871

  Details

  Description:

  Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. Note: This CVE is not exploitable for Solaris 11.1 and later releases, and ZFSSA 8.7 and later releases, thus the CVSS Base Score is 0.0. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

  PoC:

  http://packetstormsecurity.com/files/160510/Solaris-SunSSH-11.0-x86-libpam-Remote-Root.html

  Reference:

  http://packetstormsecurity.com/files/159961/SunSSH-Solaris-10-x86-Remote-Root.html

• CVE ID: CVE-2020-17463

  Details

  Description:

  FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.

  PoC:

  http://packetstormsecurity.com/files/158840/Fuel-CMS-1.4.7-SQL-Injection.html

  Reference:

  https://cwe.mitre.org/data/definitions/89.html

• CVE ID: CVE-2020-8218

  Details

  Description:

  A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.

  PoC:

  https://www.gosecure.net/blog/2020/11/13/forget-your-perimeter-part-2-four-vulnerabilities-in-pulse-connect-secure/

  Reference:

  https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516

• CVE ID: CVE-2020-10987

  Details

  Description:

  The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter.

  PoC:

  https://blog.securityevaluators.com/tenda-ac1900-vulnerabilities-discovered-and-exploited-e8e26aa0bc68

  Reference:

  https://www.ise.io/research/

• CVE ID: CVE-2020-8195

  Details

  Description:

  Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.

  PoC:

  http://packetstormsecurity.com/files/160047/Citrix-ADC-NetScaler-Local-File-Inclusion.html

  Reference:

  https://support.citrix.com/article/CTX276688

• CVE ID: CVE-2020-9377

  Details

  Description:

  ** UNSUPPORTED WHEN ASSIGNED ** D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

  PoC:

  https://gist.github.com/GouveaHeitor/131557f9de7d571f118f59805df852dc

  Reference:

  https://www.dlink.com.br/produto/dir-610/

• CVE ID: CVE-2020-11899

  Details

  Description:

  The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.

  PoC:

  https://www.jsof-tech.com/ripple20/

  Reference:

  http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt

• CVE ID: CVE-2020-8816

  Details

  Description:

  Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.

  PoC:

  https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi-hole-remote-code-execution/

  Reference:

  http://packetstormsecurity.com/files/157861/Pi-Hole-4.3.2-DHCP-MAC-OS-Command-Execution.html

• CVE ID: CVE-2020-5741

  Details

  Description:

  Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.

  PoC:

  http://packetstormsecurity.com/files/158470/Plex-Unpickle-Dict-Windows-Remote-Code-Execution.html

  Reference:

  N/A