| Название | Unauthenticated backup file download with hardcoded credentials - Netis / NetCore Routers |
|---|
| Описание | The server does not perform authentication validation for downloading the backup file, thus allowing arbitrary users to be able to extract the device's credentials easily, quickly and without being authenticated.
To replicate the vulnerability, simply paste the address of the vulnerable service and add the path /param.file.tgz to the end of it. Doing so will start an automatic download and the downloaded file will contain the credentials in plain text.
To identify some devices exposed on the network, I used shodan.
Below is the link with the query:
https://www.shodan.io/search?query=%22Server%3A+HTTP+Software+1.1%22+HTTP%2F1.1+401+
The credentials are the two words after the word "guest" and a random number, as in the example below where the credentials are admin:admin:
netcore Router guest 0 € admin admin
It was not possible to accurately identify the affected versions, but it was observed that all vulnerable devices have the same pattern of headers mentioned above, in the shodan link with the queries. |
|---|
| Источник | ⚠️ http://x.x.x.x:8080/param.file.tgz |
|---|
| Пользователь | c4ng4c3ir0 (UID 38456) |
|---|
| Представление | 07.01.2023 00:17 (3 лет назад) |
|---|
| Модерация | 07.01.2023 09:22 (9 hours later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 217591 [Netis Netcore Router до 2.2.6 Backup param.file.tgz раскрытие информации] |
|---|
| Баллы | 17 |
|---|