Listen to this Post
How the CVE Works
The vulnerability exists due to improper access control in the web component of CentreStack and TrioFox. In its default configuration, the software exposes a specific HTTP endpoint that handles user requests for file operations. This endpoint does not adequately validate or sanitize user-supplied input used to specify a file path. An unauthenticated attacker can send a specially crafted HTTP request containing directory traversal sequences (e.g., ../../) in this parameter. The application, failing to restrict the path to a designated safe directory, will process the traversal sequences and retrieve the contents of any file accessible to the web server process. This allows for the disclosure of sensitive operating system files, such as `/etc/passwd` on Linux or `C:\Windows\win.ini` on Windows, leading to a significant information leak and potential system compromise.
Platform: CentreStack, TrioFox
Version: <= 16.7.10368.56560
Vulnerability : Local File Inclusion
Severity: Critical
date: 2024-10-10
Prediction: Patch by 2024-11-15
What Undercode Say:
curl -s "http://target:port/api/v1/file?path=../../../../etc/passwd"
for file in /etc/passwd /etc/shadow /windows/system32/config/sam; do curl -s "http://$TARGET/file.php?include=$file" done
How Exploit:
Craft HTTP request with path traversal sequences in the vulnerable parameter to read arbitrary files from the server’s filesystem without authentication.
Protection from this CVE
Apply vendor patch. Implement strict input validation for all user-controlled parameters, rejecting requests containing path traversal sequences. Run the service with least privilege access.
Impact:
Unauthenticated system file disclosure, credential exposure, and complete system compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
