PT-2017-17129 · Dnalims · Dnalims

H00Die + 2 · Published 2017-03-09 · Updated 2017-08-16 · CVE-2017-6527

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions dnaLIMS version 4-2015s13

Description An issue was discovered in dnaLIMS, allowing an unauthenticated attacker to access system files readable by the web server user through a NUL-terminated directory traversal attack. This is achieved by exploiting the seqID parameter in the "viewAppletFsa.cgi" endpoint.

Recommendations For dnaLIMS version 4-2015s13, consider restricting access to the "viewAppletFsa.cgi" endpoint to prevent exploitation. Additionally, avoid using the seqID parameter in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-6527

Affected Products

Dnalims

References · 6

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/dnalims_file_retrieve.rb · Exploit
• 🔥 https://exploit-db.com/exploits/41578 · Exploit
• 🔥 https://shorebreaksecurity.com/blog/product-security-advisory-psa0002-dnalims · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-6527 · Security Note
• https://osv.dev/vulnerability/CVE-2017-6527 · Vendor Advisory
• http://securityfocus.com/bid/96823 · Note