CVE-2017-9382 Information

Description

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be accessed via port 80 using the url \/port_3480. It seems that the UPnP services provide \file\ as one of the service actions for a normal user to read a file that is stored under the /etc/cmh-lu folder. It retrieves the value from the \parameters\ query string variable and then passes it to an internal function \FileUtils::ReadFileIntoBuffer\ which is a library function that does not perform any sanitization on the value submitted and this allows an attacker to use directory traversal characters ../\ and read files from other folders within the device.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Reference

http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.html https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdf https://seclists.org/bugtraq/2019/Jun/8 An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be accessed via port 80 using the url \/port_3480. It seems that the UPnP services provide \file\ as one of the service actions for a normal user to read a file that is stored under the /etc/cmh-lu folder. It retrieves the value from the \parameters\ query string variable and then passes it to an internal function \FileUtils::ReadFileIntoBuffer\ which is a library function that does not perform any sanitization on the value submitted and this allows an attacker to use directory traversal characters ../\ and read files from other folders within the device.

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

NONE

Base Score

NONE

Base Severity

6.5