CVE-2023-47313: CVE-2023-47313 – Headwind MDM Web panel 5.22.1 – File Reading via Uncontrolled File Operation - Boltonshield

Published CVE numbers:

• https://www.cve.org/CVERecord?id=CVE-2023-47313

• https://nvd.nist.gov/vuln/detail/CVE-2023-47313

Headwind MDM Web panel 5.22.1 is vulnerable to Directory Traversal. The application uses an API call to move the uploaded temporary file to the file directory during the file upload process. This API call receives two input parameters, such as path and localPath. The first one refers to the temporary file with an absolute path without validating it. Attackers may modify this API call by referring to arbitrary files. As a result, arbitrary files can be moved to the files directory and so they can be downloaded.

Exploitation’s steps

Authentication: Required (a low-level user access is enough)

• due the vulnerability CVE-2023-47316 even low-level users can access the file-management function

• setting up an attacker proxy like burp to intercept and to modify outgoing HTTP requests

• Adding a file with an arbitrary filename and content and intercepting the outgoing HTTP requests

• The first request just uploads the file in binary format. It is not needed to modify it.

• The second request (/rest/private/web-ui-files/move POST) is the one to be modified as this one moves the uploaded file from the temporary location to the files directory located under the web root. Attackers can modify the path parameter according to what they want to retrieve.

Moving the /etc/hosts file to the files directory

​​

Hosts file can be downloaded

​