Executive Summary

[{'type': 'paragraph', 'content': "This vulnerability affects IntelBras Telefone IP TIP200 and 200 LITE devices. It is an unauthenticated arbitrary file read flaw in the dumpConfigFile function accessible via the cgiServer.exx endpoint. Attackers can send specially crafted GET requests to the device's /cgi-bin/cgiServer.exx endpoint with a command parameter invoking dumpConfigFile() to read sensitive files on the device without any authentication."}, {'type': 'paragraph', 'content': 'The vulnerability allows reading of critical files such as /etc/shadow, which contains hashed passwords, and various configuration files. This means an attacker can remotely access sensitive information stored on the device without needing any credentials or prior authorization.'}] [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts because it allows an attacker to remotely read sensitive files on the affected device without authentication. Exposure of files like /etc/shadow can reveal hashed passwords for critical users such as root, admin, and guest.

With access to these sensitive files, an attacker could potentially escalate privileges, gain unauthorized control over the device, or use the information to compromise other parts of the network. The confidentiality of sensitive configuration and credential data is compromised, increasing the risk of further attacks.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': "This vulnerability can be detected by sending HTTP GET requests to the vulnerable device's CGI endpoint to check if arbitrary files can be read without authentication."}, {'type': 'paragraph', 'content': 'A typical detection command involves requesting the /cgi-bin/cgiServer.exx endpoint with the command parameter set to dumpConfigFile() targeting sensitive files such as /etc/shadow.'}, {'type': 'paragraph', 'content': 'For example, you can use curl to test the vulnerability:'}, {'type': 'list_item', 'content': 'curl -k "http://<target-ip>/cgi-bin/cgiServer.exx?command=dumpConfigFile(%22/etc/shadow%22)"'}, {'type': 'paragraph', 'content': 'If the response contains the contents of the requested file (e.g., /etc/shadow), the device is vulnerable.'}, {'type': 'paragraph', 'content': 'Additionally, the exploit described in Resource 1 uses a Perl script that automates this process by sending crafted HTTP requests and analyzing the responses.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

I don't know

Useful 0 Not Useful 0