module

Grandstream UCM62xx IP PBX sendPasswordEmail RCE

Try Surface Command
Back to search
Disclosed
Mar 23, 2020
Created
Jan 25, 2022

Description

This module exploits an unauthenticated SQL injection vulnerability (CVE-2020-5722) and
a command injection vulnerability (technically, no assigned CVE but was inadvertently
patched at the same time as CVE-2019-10662) affecting the Grandstream UCM62xx IP PBX
series of devices. The vulnerabilities allow an unauthenticated remote attacker to
execute commands as root.

Exploitation happens in two stages:

1. An SQL injection during username lookup while executing the "Forgot Password" function.
2. A command injection that occurs after the user provided username is passed to a Python script
via the shell. Like so:

/bin/sh -c python /app/asterisk/var/lib/asterisk/scripts/sendMail.py \
password '' `cat
This module affect UCM62xx versions before firmware version 1.0.19.20.

Author

jbaines-r7

Platform

Linux,Unix

Architectures

cmd, armle

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use exploit/linux/http/grandstream_ucm62xx_sendemail_rce
    msf exploit(grandstream_ucm62xx_sendemail_rce) > show targets
        ...targets...
    msf exploit(grandstream_ucm62xx_sendemail_rce) > set TARGET < target-id >
    msf exploit(grandstream_ucm62xx_sendemail_rce) > show options
        ...show and set options...
    msf exploit(grandstream_ucm62xx_sendemail_rce) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today