CVE-2017-2916

🗓️ 07 Nov 2017 16:00:00Reported by talosType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 85 Views🌐 WEB

An exploitable vulnerability in Circle with Disney firmware 2.0.1 allows arbitrary file overwrite via specially crafted network packets

Reporter	Title	Published	Views	Family All 11
CNVD	Circle with Disney Backlink Vulnerability	2 Nov 201700:00	–	cnvd
Cvelist	CVE-2017-2916	7 Nov 201716:00	–	cvelist
EUVD	EUVD-2017-12057	7 Oct 202500:30	–	euvd
NVD	CVE-2017-2916	7 Nov 201716:29	–	nvd
osv_cve	CVE-2017-2916	7 Nov 201716:29	–	osv_cve
Prion	Cross site request forgery (csrf)	7 Nov 201716:29	–	prion
Positive Technologies	PT-2017-15613	7 Nov 201700:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2017-2916: Improper Link Resolution Before File Access	7 Nov 201700:00	–	rapid7
seebug.org	Circle with Disney Configuration Restore Photos File Overwrite Vulnerability(CVE-2017-2916)	8 Nov 201700:00	–	seebug
Talos	Circle with Disney Configuration Restore Photos File Overwrite Vulnerability	31 Oct 201700:00	–	talos

NVD

Node

AND

meetcircle circle_with_disney_firmwareMatch2.0.1

meetcircle circle_with_disneyMatch-

[
  {
    "product": "Circle",
    "vendor": "Circle Media",
    "versions": [
      {
        "status": "affected",
        "version": "firmware 2.0.1"
      }
    ]
  }
]

Source	Link
talosintelligence	www.talosintelligence.com/vulnerability_reports/TALOS-2017-0423

Parameter	Position	Path	Description	CWE
token	request body	/api/CONFIG/restore	The /api/CONFIG/restore endpoint allows an attacker to upload a specially crafted encrypted backup archive. If the archive contains a symbolic link within the 'photos' directory pointing to a system file, the subsequent restoration process will overwrite that system file with arbitrary data.	CWE-59
appid	request body	/api/CONFIG/restore	The /api/CONFIG/restore endpoint allows an attacker to upload a specially crafted encrypted backup archive. If the archive contains a symbolic link within the 'photos' directory pointing to a system file, the subsequent restoration process will overwrite that system file with arbitrary data.	CWE-59
upload	request body	/api/CONFIG/restore	The /api/CONFIG/restore endpoint allows an attacker to upload a specially crafted encrypted backup archive. If the archive contains a symbolic link within the 'photos' directory pointing to a system file, the subsequent restoration process will overwrite that system file with arbitrary data.	CWE-59
token	request body	/api/UPDATE/users/user/photo	This endpoint can be used to overwrite a file on the system if the attacker has previously used /api/CONFIG/restore to create a symbolic link in the photos directory pointing to that file.	CWE-59
user.pid	request body	/api/UPDATE/users/user/photo	This endpoint can be used to overwrite a file on the system if the attacker has previously used /api/CONFIG/restore to create a symbolic link in the photos directory pointing to that file.	CWE-59
photo	request body	/api/UPDATE/users/user/photo	This endpoint can be used to overwrite a file on the system if the attacker has previously used /api/CONFIG/restore to create a symbolic link in the photos directory pointing to that file.	CWE-59