PT-2017-4227 · Boa · Boa

Miguel Mendez Z · Publicado 2017-06-20 · Atualizado 2024-08-05 · CVE-2017-9833

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Boa version 0.94.14rc21

Description The issue is related to the /cgi-bin/wapopen script in the Boa HTTP server, which is vulnerable to path traversal attacks using the FILECAMERA variable sent via GET requests. This could allow a remote attacker to gain unauthorized access to protected information by sending specially crafted requests. It is noted that this might be a system-integrator issue rather than a vulnerability in Boa itself, as Boa does not include any wapopen program or code to read the FILECAMERA variable.

Recommendations For Boa version 0.94.14rc21, consider disabling the /cgi-bin/wapopen script until a patch is available, or restrict access to this script to minimize the risk of exploitation. Additionally, avoid using the FILECAMERA variable in the affected API endpoint until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2022-07373

CVE-2017-9833

Produtos afetados

Boa

Referências · 11

• 🔥 https://exploit-db.com/exploits/42290 · Exploit
• 🔥 https://pastebin.com/raw/rt7LJvyF · Exploit
• https://t.me/cvenotify/39375 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2017-9833 · Nota de Segurança
• https://t.me/cvenotify/89261 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2022-07373 · Nota de Segurança
• https://xakep.ru/2022/11/24/boa-iot · Nota
• https://itsec.ru/news/zloumishlenniki-vzlamivayut-energoseti-ispolzuya-uyazvimosti-v-ustarevshem-po · Nota
• https://securitylab.ru/news/534938.php · Nota
• https://t.me/cvenotify/44322 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2017-9833 · Aviso do Fabricante