Meinberg LANTIME Web Configuration Utility 6.16.008 – Arbitrary File Read

• Exploit Database
• 114 阅读

• 作者： Jakub Palaczynski
  日期： 2017-12-13
• 类别：

  • webapps
  平台：

  • cgi
• 来源：https://www.exploit-db.com/exploits/43332/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

  Title: Meinberg LANTIME Web Configuration Utility - Arbitrary File Read Author: Jakub Palaczynski CVE: CVE-2017-16787     Exploit tested on: ==================   Meinberg LANTIME Web Configuration Utility 6.16.008     Vulnerability affects: ====================== All LTOS6 firmware releases before 6.24.004     Vulnerability: **************   Arbitrary File Read: ====================   It is possible to read arbitrary file on the system with root permissions   Proof of Concept: First instance: https://host/cgi-bin/mainv2?value=800&showntpclientipinfo=xxx&ntpclientcounterlogfile=/etc/passwd&lcs=xxx Info-User user is able to read any file on the system with root permissions.   Second instance: User with Admin-User access is able to read any file on the system via firmware update functionality. Curl accepts "file" schema which actually downloads file from the filesystem. Then it is possible to download /upload/update file which contains content of requested file.   Contact: ========   Jakub[dot]Palaczynski[at]gmail[dot]com