Skip to content
Nuclei Templates

RED-V Super Digital Signage System RXV-A740R - Log Information Disclosure

ID: redv-super-logs

Severity: medium

Author: r3Y3r53

Tags: redv,log,disclosure,exposure

Description

Section titled “Description”

The application is vulnerable to sensitive information disclosure vulnerability. An unauthenticated attacker can visit several endpoints and disclose the webserver’s log file list containing sensitive system resources and debug log information running on the device.

YAML Source

Section titled “YAML Source”
id: redv-super-logs


info:
  name: RED-V Super Digital Signage System RXV-A740R - Log Information Disclosure
  author: r3Y3r53
  severity: medium
  description: |
    The application is vulnerable to sensitive information disclosure vulnerability. An unauthenticated attacker can visit several endpoints and disclose the webserver's log file list containing sensitive system resources and debug log information running on the device.
  reference:
    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5609.php
  metadata:
    verified: true
    max-request: 1
  tags: redv,log,disclosure,exposure


http:
  - method: GET
    path:
      - "{{BaseURL}}/downloader.log"


    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/plain")'
          - 'contains_all(body, "Log file", "[LogParser]", "[INFO]")'
        condition: and
# digest: 4b0a00483046022100db1278d8eb7250317e5135150d297edf6d6915ee0bce4b462f88838d14d44476022100f9ba989bba7b936f4c9f3fd753c38fe9c2a39b26a1d195892300f51c747d32f2:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/exposures/logs/redv-super-logs.yaml"

View on Github