This module exploits an authentication bypass (CVE-2021-1472) and command injection (CVE-2021-1473) in the Cisco Small Business RV series of VPN/routers. The device does not adequately verify the credentials in the HTTP Authorization field when requests are made to the /upload endpoint. Then the upload.cgi binary will use the contents of the HTTP Cookie field as part of a `curl` request aimed at an internal endpoint. The curl request is executed using `popen` and allows the attacker to inject commands via the Cookie field. A remote and unauthenticated attacker using this module is able to achieve code execution as `www-data`. This module affects the RV340, RV340w, RV345, and RV345P using firmware versions 1.0.03.20 and below.
Linux,Unix
cmd, armle
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/linux/http/cisco_rv_series_authbypass_and_rce
msf exploit(cisco_rv_series_authbypass_and_rce) > show targets
...targets...
msf exploit(cisco_rv_series_authbypass_and_rce) > set TARGET < target-id >
msf exploit(cisco_rv_series_authbypass_and_rce) > show options
...show and set options...
msf exploit(cisco_rv_series_authbypass_and_rce) > exploit
Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.
– Jim O’Gorman | President, Offensive Security