| Titolo | D-Link DIR-878 1.20B05 Path Traversal |
|---|
| Descrizione | A path traversal vulnerability was discovered in D-Link DIR-878 (REV A) firmware v1.20B05. The GetListDirectory HNAP handler in bin/prog.cgi (0x4934fc) concatenates the user-controlled ListDirectoryPath field with snprintf("/mnt%s") and passes it directly to opendir(); the supposed validation function (0x493134) contains no ".." or absolute-path check and is merely an opendir/readdir entry counter. The endpoint is reachable without any credentials. Reproduction: curl -X POST /HNAP1/?GetCAPTCHAsetting with SOAPAction GetListDirectory and ListDirectoryPath=/../usr returns HTTP 200 listing the first-level subdirectory names of /usr (local, lib, codepages, sbin, bin); /../var likewise lists tmp, run, web, private; the baseline path / returns an empty list. An unauthenticated adjacent-network attacker can enumerate first-level directory names under arbitrary paths outside /mnt, gaining filesystem-structure reconnaissance for staging further attacks. File contents cannot be read and regular files are not listed (directory entries only). Proposed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (3.5). Discovered by Zimo-666 via static reverse engineering and dynamic differential testing. |
|---|
| Fonte | ⚠️ https://github.com/Zimo-666/DIR-878-cves/tree/main/06-getlistdirectory-path-traversal |
|---|
| Utente | ha ha-yang (UID 102151) |
|---|
| Sottomissione | 15/10/2026 09:49 (24 giorni fa) |
|---|
| Moderazione | 08/11/2026 15:47 (24 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 432896 [D-Link DIR-878 1.20B05 HNAP bin/prog.cgi GetListDirectory ListDirectoryPath directory traversal] |
|---|
| Punti | 20 |
|---|