Skip to content

Latest commit

 

History

History
11 lines (11 loc) · 1.93 KB

CVE-2024-40088.md

File metadata and controls

11 lines (11 loc) · 1.93 KB
Raw

CVE-2024-40088: Arbitrary File Enumeration in Boa Webserver

  • CVSS Score - 4.7, Medium (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)
  • Affected Product - Vilo 5 Mesh WiFi System
  • Affected Firmware - versions <= 5.16.1.33
  • Overview - the custom TCP service running on port 5432 has several functions, one of which includes spinning up a webserver stored at /hualai/boa/boa on port 8023. Since this service has no authentication, anyone can spin up the webserver. This webserver not only offers up system logs to anyone with access, but by putting path traversal payloads ../../ in the path, any file can be enumerated from the server.
  • Description
    • The Boa webserver is designed to offer up log files for the user to retrieve. The path sent in the HTTP request is processed by the server and checked that it is a valid file relative to the /tmp directory. This means sending an HTTP request with the first line like GET /../../../etc/passwd will manipulate the server into checking the existence of the /etc/passwd file. Then, the length of the user-supplied file is passed in as a parameter, and that many bytes of the log will be returned to the user.
    • For example, if /../../../etc/passwd was supplied and the /etc/passwd file is exactly 27 bytes long, then the first 27 bytes of the logfile will be returned. If the file length is longer than the logfile, then null bytes will be returned (assuming no memory sections are placed afterwards).
  • Steps to Reproduce
    • Run the command curl https://192.168.58.1:8023/../../../../etc/passwd -k --path-as-is and note that a 404 "Not Found" error is not returned.
  • Impact - Anyone on the LAN can enumerate the existence of and length of any file on the filesystem. Note that they cannot read the actual contents, however.