CVE-2017-2916

🗓️ 07 Nov 2017 16:00:00Reported by talosType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 83 Views🌐 WEB

An exploitable vulnerability in Circle with Disney firmware 2.0.1 allows arbitrary file overwrite via specially crafted network packets

Reporter	Title	Published	Views	Family All 11
CNVD	Circle with Disney Backlink Vulnerability	2 Nov 201700:00	–	cnvd
Cvelist	CVE-2017-2916	7 Nov 201716:00	–	cvelist
EUVD	EUVD-2017-12057	7 Oct 202500:30	–	euvd
NVD	CVE-2017-2916	7 Nov 201716:29	–	nvd
OSV	CVE-2017-2916	7 Nov 201716:29	–	osv
Prion	Cross site request forgery (csrf)	7 Nov 201716:29	–	prion
Positive Technologies	PT-2017-15613	7 Nov 201700:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2017-2916: Improper Link Resolution Before File Access	7 Nov 201700:00	–	rapid7
seebug.org	Circle with Disney Configuration Restore Photos File Overwrite Vulnerability(CVE-2017-2916)	8 Nov 201700:00	–	seebug
Talos	Circle with Disney Configuration Restore Photos File Overwrite Vulnerability	31 Oct 201700:00	–	talos

NVD

Node

AND

meetcircle circle_with_disney_firmwareMatch2.0.1

meetcircle circle_with_disneyMatch-

[
  {
    "product": "Circle",
    "vendor": "Circle Media",
    "versions": [
      {
        "status": "affected",
        "version": "firmware 2.0.1"
      }
    ]
  }
]

Source	Link
talosintelligence	www.talosintelligence.com/vulnerability_reports/TALOS-2017-0423

Parameter	Position	Path	Description	CWE
token	binary	/api/CONFIG/restore	Arbitrary file overwrite via crafted backup uploaded to /api/CONFIG/restore; the restoration process decrypts and extracts the backup and can overwrite arbitrary files through a symlink in the photos directory.	CWE-59
appid	binary	/api/CONFIG/restore	Arbitrary file overwrite via crafted backup uploaded to /api/CONFIG/restore; the restoration process decrypts and extracts the backup and can overwrite arbitrary files through a symlink in the photos directory.	CWE-59
upload	binary	/api/CONFIG/restore	Arbitrary file overwrite via crafted backup uploaded to /api/CONFIG/restore; the restoration process decrypts and extracts the backup and can overwrite arbitrary files through a symlink in the photos directory.	CWE-59
token	request body	/api/UPDATE/users/user/photo	Using the photo upload endpoint, an attacker can overwrite system files by placing a symbolic link in the photos directory that is copied to the target location, enabling arbitrary file overwrite (e.g., overwriting check_system_time.sh).	CWE-59
user.pid	request body	/api/UPDATE/users/user/photo	Using the photo upload endpoint, an attacker can overwrite system files by placing a symbolic link in the photos directory that is copied to the target location, enabling arbitrary file overwrite (e.g., overwriting check_system_time.sh).	CWE-59
photo	request body	/api/UPDATE/users/user/photo	Using the photo upload endpoint, an attacker can overwrite system files by placing a symbolic link in the photos directory that is copied to the target location, enabling arbitrary file overwrite (e.g., overwriting check_system_time.sh).	CWE-59