RAVPower FileHub 2.000.056 HTTP Server unrestricted upload

Summaryinfo

A vulnerability was found in RAVPower FileHub 2.000.056 and classified as critical. Affected is an unknown function of the component HTTP Server. The manipulation results in unrestricted upload. This vulnerability is reported as CVE-2018-5997. The attack can be launched remotely. Moreover, an exploit is present.

Detailsinfo

A vulnerability was found in RAVPower FileHub 2.000.056. It has been classified as critical. Affected is an unknown code of the component HTTP Server. The manipulation with an unknown input leads to a unrestricted upload vulnerability. CWE is classifying the issue as CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered in the HTTP Server in RAVPower Filehub 2.000.056. Due to an unrestricted upload feature and a path traversal vulnerability, it is possible to upload a file on a filesystem with root privileges: this will lead to remote code execution as root.

The bug was discovered 01/23/2018. The weakness was disclosed 01/25/2018 as EDB-ID 43871 as not defined exploit (Exploit-DB). The advisory is shared for download at exploit-db.com. This vulnerability is traded as CVE-2018-5997 since 01/22/2018. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1608.002.

After immediately, there has been an exploit disclosed. The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 2 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (43871). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• RAVPower

Name

• FileHub

Version

• 2.000.056

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion