Description
SnapGear Management Console SG560 3.1.5 contains a file manipulation vulnerability that allows authenticated users to read, write, and delete files using the edit_config_files CGI script. Attackers can manipulate POST request parameters in /cgi-bin/cgix/edit_config_files to access and modify files outside the intended /etc/config/ directory.
Problem types
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Product status
Credits
LiquidWorm as Gjoko Krstic of Zero Science Lab
References
www.exploit-db.com/exploits/48556 (ExploitDB-48556)
www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5568.php (Zero Science Lab Disclosure (ZSL-2020-5568))
packetstorm.news/files/id/157939 (Packet Storm Security Exploit Entry)
exchange.xforce.ibmcloud.com/vulnerabilities/182960 (IBM X-Force Vulnerability Exchange)
www.vulncheck.com/...ent-console-sg-arbitrary-file-readwrite (VulnCheck Advisory: Secure Computing SnapGear Management Console SG560 3.1.5 Arbitrary File Read/Write)