Executive Summary

CVE-2021-47850 is a path traversal vulnerability in Mini Mouse version 9.2.0. It allows remote attackers to send specially crafted HTTP requests that manipulate file and path parameters to access arbitrary system files and directories. This means attackers can retrieve sensitive files like 'win.ini' and list contents of system directories such as 'C:\Users\Public' without authorization. [1, 2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive system files and directory contents. Attackers can access configuration files and potentially sensitive data stored on the system, which may lead to further attacks or information leakage. Because the vulnerability requires no privileges or user interaction, it can be exploited remotely over the network, increasing the risk to affected systems. [1, 2]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending crafted HTTP requests to the Mini Mouse 9.2.0 application's web interface and observing if arbitrary files or directory listings are returned. For example, you can use curl commands to test the vulnerability: 1. To retrieve the contents of a sensitive file like win.ini: curl -i "http://<target-ip>/file=C:\Windows\win.ini" 2. To list contents of a directory such as C:\Users\Public: curl -X POST -H "Content-Type: application/json" -d '{"path":"C:\\Users\\Public"}' "http://<target-ip>/op=get_file_list" If the server responds with the file contents or directory listing, the system is vulnerable. [2]

Useful 0 Not Useful 0

Compliance Impact

The provided resources do not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0