{
  "Name": "Avaya Aura Default Credentials",
  "Description": "The Avaya Aura administrator 'admin' has a password that is set to the default value of 'admin01'. As a result, anyone with access to the DARC port can trivially gain full access to the machine via arbitrary remote code execution. ",
  "Product": "Avaya-Aura",
  "Homepage": "https://www.devconnectprogram.com/",
  "DisclosureDate": "2012-04-23",
  "Author": "gobysec@gmail.com",
  "FofaQuery": "body=\"avx_header_bg\"",
  "Level": "3",
  "Impact": "Remote attacker can use this default to control the server.",
  "Recommendation": "It is imperative to change default manufacturer passwords and restrict network access to critical and important systems.",
  "References": [
    "https://fofa.so/"
  ],
  "HasExp": false,
  "ExpParams": [],
  "ExpTips": {
    "Type": "Tips",
    "Content": ""
  },
  "ScanSteps": [
    "AND",
	{
         "Request": {
           "follow_redirect": true,
           "method": "GET",
           "uri": "/"
         },
         "ResponseTest": {
           "checks": [
             {
               "operation": "contains",
               "type": "item",
               "value": "j_username",
               "variable": "$body"
             }
           ],
           "operation": "AND",
           "type": "group"
         },
         "SetVariable": []
    },
	{
		"BruteForce": {
			"protocol": "http_form",
			"UserPassPairs": ["admin:admin01","admin:admin123"],
			"Request": {
			   "data": "j_username={{{username}}}&j_password={{{password}}}&clientTZ=-480&clientTZName=Asia%2FTaipei",
			   "data_type": "text",
			   "follow_redirect": false,
			   "header": {
				 "Content-Type": "application/x-www-form-urlencoded"
			   },
			   "method": "POST",
			   "uri": "/network-login/j_security_check"
			 },
			"ResponseTest": {
			   "checks": [
				 {
				   "operation": "contains",
				   "type": "item",
				   "value": "/network-login/loginRouter.jsp",
				   "variable": "$head"
				 }
			   ],
			   "operation": "AND",
			   "type": "group"
			 }
		}
	}
  ],
  "ExploitSteps": null,
  "Tags": [
    "defaultaccount"
  ],
  "CVEIDs": null,
  "CVSSScore": "10.0",
  "AttackSurfaces": {
    "Application": ["Avaya-Aura"],
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": null
  },
  "Disable": false
}