Description
This module exploits an authentication bypass (CVE-2021-1472) and command injection (CVE-2021-1473) in the Cisco Small Business RV series of VPN/routers. The device does not adequately verify the credentials in the HTTP Authorization field when requests are made to the /upload endpoint. Then the upload.cgi binary will use the contents of the HTTP Cookie field as part of a `curl` request aimed at an internal endpoint. The curl request is executed using `popen` and allows the attacker to inject commands via the Cookie field.
A remote and unauthenticated attacker using this module is able to achieve code execution as `www-data`.
This module affects the RV340, RV340w, RV345, and RV345P using firmware versions 1.0.03.20 and below.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/linux/http/cisco/rv_series_authbypass_and_rcemsf undefined(rv_series_authbypass_and_rce) > show actions ...actions...msf undefined(rv_series_authbypass_and_rce) > set ACTION < action-name >msf undefined(rv_series_authbypass_and_rce) > show options ...show and set options...msf undefined(rv_series_authbypass_and_rce) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub