full-disclosure - [FD] Meinberg LANTIME Web Configuration Utility

Open Source and information security mailing list archives

Message-ID: <CALxzxN240Gp-0PFdFGFJHLMdQd=xPTgb=v-Rm6wxRSXMd1vadQ@mail.gmail.com>
Date: Mon, 11 Dec 2017 17:43:02 +0100
From: Jakub Palaczynski <jakub.palaczynski@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] Meinberg LANTIME Web Configuration Utility - Arbitrary File
	Upload

Title: Meinberg LANTIME Web Configuration Utility - Arbitrary File Upload
(Path Traversal)
Author: Jakub Palaczynski
CVE: CVE-2017-16788

Exploit was tested on:
======================

Meinberg LANTIME Web Configuration Utility 6.16.008

Vulnerability affects:
======================
All LTOS6 firmware releases before 6.24.004

Vulnerability:
**************

Arbitrary File Upload (Path Traversal):
=======================================

It is possible to upload any file to any location on the server.

Proof of Concept:
"Upload Groupkey" functionality allows for uploading any file to any
location on the server. An attacker may use path traversal to store files
in for example cron.d directory and execute them automatically to get root
access on the system.
This vulnerability allows for getting root access on the system from
Admin-User access.

Contact:
========

Jakub[dot]Palaczynski[at]gmail[dot]com

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives