| Title | Unauthenticated backup file download with hardcoded credentials - Netis / NetCore Routers |
|---|
| Description | The server does not perform authentication validation for downloading the backup file, thus allowing arbitrary users to be able to extract the device's credentials easily, quickly and without being authenticated.
To replicate the vulnerability, simply paste the address of the vulnerable service and add the path /param.file.tgz to the end of it. Doing so will start an automatic download and the downloaded file will contain the credentials in plain text.
To identify some devices exposed on the network, I used shodan.
Below is the link with the query:
https://www.shodan.io/search?query=%22Server%3A+HTTP+Software+1.1%22+HTTP%2F1.1+401+
The credentials are the two words after the word "guest" and a random number, as in the example below where the credentials are admin:admin:
netcore Router guest 0 € admin admin
It was not possible to accurately identify the affected versions, but it was observed that all vulnerable devices have the same pattern of headers mentioned above, in the shodan link with the queries. |
|---|
| Source | ⚠️ http://x.x.x.x:8080/param.file.tgz |
|---|
| User | c4ng4c3ir0 (UID 38456) |
|---|
| Submission | 01/07/2023 00:17 (3 years ago) |
|---|
| Moderation | 01/07/2023 09:22 (9 hours later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 217591 [Netis Netcore Router up to 2.2.6 Backup param.file.tgz information disclosure] |
|---|
| Points | 17 |
|---|