| शीर्षक | https://www.enms.io/ eNMS 4.2 REMOTE CODE EXECUTION VIA ZIP SLIP |
|---|
| विवरण | The vulnerability lies in the Controller.py file, specifically in the import_Services.py file at line 1089. There is an issue where a .tar file is uploaded, and the file name and the names of the files inside the .tar archive are not validated before extraction. As shown in the example code:
with open_tar(filepath) as tar_file:
tar_file.extractall(path=vs.file_path / "services")
This creates a ZIP Slip vulnerability because an attacker can control the file names. For example, by including a file named ../../../../.ssh/authorized_keys inside the .tar archive and modifying its content with their SSH key, the attacker can overwrite sensitive files. This would allow the attacker to gain SSH access to the system.
PRIVATE POC VIDEO:
https://www.youtube.com/watch?v=FJVFtNb4_qA |
|---|
| स्रोत | ⚠️ https://security.snyk.io/research/zip-slip-vulnerability |
|---|
| उपयोगकर्ता | slash0x99 (UID 77812) |
|---|
| सबमिशन | 19/11/2024 11:52 AM (2 साल पहले) |
|---|
| संयम | 24/11/2024 05:32 PM (5 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 285986 [eNMS तक 4.2 TGZ File eNMS/controller.py multiselect_filtering निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 0 |
|---|