{
  "Name": "unraid 6.8.0 authenticate bypass remote code execution(CVE-2020-5847)",
  "Description": "Unraid through 6.8.0 allows Remote Code Execution.",
  "Product": "Unraid",
  "Homepage": "https://unraid.net/product",
  "DisclosureDate": "2020-03-16",
  "Author": "mahui@gobies.org",
  "GifAddress": "https://raw.githubusercontent.com/gobysec/GobyVuls/master/Unraid/CVE-2020-5847/CVE-2020-5847.gif",
  "FofaQuery": "body=\"/webGui/images/green-on.png\"",
  "Level": "3",
  "Impact": "<p>Unraid是一套主要用于个人和小型企业的操作系统。</p><p>Unraid 6.8.0及之前版本中存在安全漏洞。攻击者可利用该漏洞绕过访问控制并执行代码，从而获取服务器权限。</p>",
  "Recommandation": "<p>厂商已在<span style=\"color: rgb(51, 51, 51); font-size: 16px;\">Unraid 6.8.0之后的版本修复了该漏洞，可前去厂商官网下载升级到新版本：<a href=\"https://unraid.net/product\">https://unraid.net/product</a></span></p>",
  "References": [
    "http://packetstormsecurity.com/files/157275/Unraid-6.8.0-Authentication-Bypass-Arbitrary-Code-Execution.html",
    "https://forums.unraid.net/forum/7-announcements/",
    "https://sysdream.com/news/lab/",
    "https://sysdream.com/news/lab/2020-02-06-cve-2020-5847-cve-2020-5849-unraid-6-8-0-unauthenticated-remote-code-execution-as-root/",
    "https://nvd.nist.gov/vuln/detail/CVE-2020-5847",
    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5847"
  ],
  "HasExp": true,
  "ExpParams": [
	{
	  "Name": "cmd",
      "Type": "input",
      "Value": "whoami"
	}
  ],
  "ExpTips": {
    "Type": "",
    "Content": ""
  },
  "ScanSteps": [
    "AND",
    {
      "Request": {
        "data": "",
        "data_type": "text",
        "follow_redirect": true,
        "method": "GET",
        "uri": ""
      },
      "ResponseTest": {
        "checks": [
          {
            "bz": "",
            "operation": "==",
            "type": "item",
            "value": "200",
            "variable": "$code"
          }
        ],
        "operation": "AND",
        "type": "group"
      }
    }
  ],
  "ExploitSteps": null,
  "Tags": ["rce"],
  "CVEIDs": [
    "CVE-2020-5847"
  ],
  "CVSSScore": "9.8",
  "AttackSurfaces": {
    "Application": null,
    "Support": null,
    "Service": null,
    "System": ["Unraid"],
    "Hardware": null
  },
  "Disable": false
}