Metasploit Module: Cisco RV110W/RV130(W)/RV215W Routers Management Interface Remote Command Execution
Type: exploit
Path: modules/exploits/linux/http/cve_2019_1663_cisco_rmi_rce.rb
Platform: %w[linux
Disclosure date: 2019-02-27
References: CVE-2019-1663, BID-107185, URL-https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190227-rmi-cmd-ex, URL-https://www.pentestpartners.com/security-blog/cisco-rv130-its-2019-but-yet-strcpy/
Targets: Cisco RV110W 1.1.0.9, Cisco RV110W 1.2.0.9, Cisco RV110W 1.2.0.10, Cisco RV110W 1.2.1.4, Cisco RV110W 1.2.1.7, Cisco RV215W 1.1.0.5, Cisco RV215W 1.1.0.6, Cisco RV215W 1.2.0.14, Cisco RV215W 1.2.0.15, Cisco RV215W 1.3.0.7

Description:
A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall,
          Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router
          could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device.

          The vulnerability is due to improper validation of user-supplied data in the web-based management interface.
          An attacker could exploit this vulnerability by sending malicious HTTP requests to a targeted device.

          A successful exploit could allow the attacker to execute arbitrary code on the underlying operating
          system of the affected device as a high-privilege user.

          RV110W Wireless-N VPN Firewall versions prior to 1.2.2.1 are affected.
          RV130W Wireless-N Multifunction VPN Router versions prior to 1.0.3.45 are affected.
          RV215W Wireless-N VPN Router versions prior to 1.3.1.1 are affected.

          Note: successful exploitation may not result in a session, and as such,
          on_new_session will never repair the HTTP server, leading to a denial-of-service condition.

Check method (fingerprinting):
# We fingerprint devices using SHA1 hash of a web resource accessible to unauthenticated users.
    # We use lang_pack/EN.js because it's the one file that changes the most between versions.
    # Note that it's not a smoking gun given that some branches keep the exact same files in /www
    # (see RV110 branch 1.2.1.x/1.2.2.x, RV130 > 1.0.3.22, RV215 1.2.0.x/1.3.x)

    fingerprints = {
      '69d906ddd59eb6755a7b9c4f46ea11cdaa47c706' => {
        'version' => 'Cisco RV110W 1.1.0.9',
        'status' => Exploit::CheckCode::Vulnerable('The target is vulnerable')
      },
      '8d3b677d870425198f7fae94d6cfe262551aa8bd' => {
        'version' => 'Cisco RV110W 1.2.0.9',
        'status' => Exploit::CheckCode::Vulnerable('The target is vulnerable')
      },
      '134ee643ec[PII_REDACTED]11193a43cc5e93c96a06' => {
        'version' => 'Cisco RV110W 1.2.0.10',
        'status' => Exploit::CheckCode::Vulnerable('The target is vulnerable')
      },
      'e3b2ec9d099a3e3468f8437e[PII_REDACTED]ff830e' => {
        'version' => 'Cisco RV110W 1.2.1.4, 1.2.1.7, 1.2.2.1 (not vulnerable), 1.2.2.4 (not vulnerable)',
        'status' => Exploit::CheckCode::Unknown('Could not determine the target status')
      },
      '6b7b1e8097e8dda26db27a09b8176b9c32b349b3' => {
        'version' => 'Cisco RV130/RV130W 1.0.0.21',
        'status' => Exploit::CheckCode::Vulnerable('The target is vulnerable')
      },
      '9b1a87b752d11c5ba97dd80d6bae[PII_REDACTED]66' => {
        'version' => 'Cisco RV130/RV130W