| 제목 | Unauthenticated backup file download with hardcoded credentials - Netis / NetCore Routers |
|---|
| 설명 | The server does not perform authentication validation for downloading the backup file, thus allowing arbitrary users to be able to extract the device's credentials easily, quickly and without being authenticated.
To replicate the vulnerability, simply paste the address of the vulnerable service and add the path /param.file.tgz to the end of it. Doing so will start an automatic download and the downloaded file will contain the credentials in plain text.
To identify some devices exposed on the network, I used shodan.
Below is the link with the query:
https://www.shodan.io/search?query=%22Server%3A+HTTP+Software+1.1%22+HTTP%2F1.1+401+
The credentials are the two words after the word "guest" and a random number, as in the example below where the credentials are admin:admin:
netcore Router guest 0 € admin admin
It was not possible to accurately identify the affected versions, but it was observed that all vulnerable devices have the same pattern of headers mentioned above, in the shodan link with the queries. |
|---|
| 원천 | ⚠️ http://x.x.x.x:8080/param.file.tgz |
|---|
| 사용자 | c4ng4c3ir0 (UID 38456) |
|---|
| 제출 | 2023. 01. 07. AM 12:17 (3 연령 ago) |
|---|
| 모더레이션 | 2023. 01. 07. AM 09:22 (9 hours later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 217591 [Netis Netcore Router 까지 2.2.6 Backup param.file.tgz 정보 공개] |
|---|
| 포인트들 | 17 |
|---|