CVE-2021-46704
Description
In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/ui/api.ts and lib/ping.ts). The vulnerability arises from insufficient input validation combined with a missing authorization check.
NVD
Severity: CRITICAL
CVE ID: CVE-2021-46704
CVSS Score: 9.8
CVSS Metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Proof Of Concept
Nuclei Templates for CVE-2021-46704
Refrence: Project Discovery GitHub
MithatGuner
CVE-2021-46704 GenieACS Command Injection POC
Refrence: GitHub
Erenlancaster
CVE-2021-46704 Nuclei template
Refrence: GitHub