Full Disclosure mailing list archives
Meinberg LANTIME Web Configuration Utility - Arbitrary File Upload
From: Jakub Palaczynski <jakub.palaczynski () gmail com>
Date: Mon, 11 Dec 2017 17:43:02 +0100
Title: Meinberg LANTIME Web Configuration Utility - Arbitrary File Upload (Path Traversal) Author: Jakub Palaczynski CVE: CVE-2017-16788 Exploit was tested on: ====================== Meinberg LANTIME Web Configuration Utility 6.16.008 Vulnerability affects: ====================== All LTOS6 firmware releases before 6.24.004 Vulnerability: ************** Arbitrary File Upload (Path Traversal): ======================================= It is possible to upload any file to any location on the server. Proof of Concept: "Upload Groupkey" functionality allows for uploading any file to any location on the server. An attacker may use path traversal to store files in for example cron.d directory and execute them automatically to get root access on the system. This vulnerability allows for getting root access on the system from Admin-User access. Contact: ======== Jakub[dot]Palaczynski[at]gmail[dot]com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- Meinberg LANTIME Web Configuration Utility - Arbitrary File Upload Jakub Palaczynski (Dec 12)