.. / CVE-2021-33357

• RCE
• Nuclei
• Web

Exploit for RaspAP <=2.6.5 - Remote Command Injection (CVE-2021-33357)

Description:

RaspAP 2.6 to 2.6.5 allows unauthenticated attackers to execute arbitrary OS commands via the “iface” GET parameter in /ajax/networking/get_netcfg.php, when the “iface” parameter value contains special characters such as “;”.

Nuclei Template

View the template here CVE-2021-33357.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-33357.yaml

References: