Local File Inclusion vulnerability in cobbler

vendor:

Cobbler

by:

Dolev Farhi

8,8

CVSS

HIGH

Local File Inclusion

CWE

Product Name: Cobbler

Affected Version From: 2.4.x

Affected Version To: 2.6.x

Patch Exists: Yes

Related CWE: N/A

CPE: a:cobbler:cobbler

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2014

Local File Inclusion vulnerability in cobbler

Cobbler is a Linux installation server that allows for rapid setup of network installation environments. A Local File Inclusion vulnerability was discovered in Cobbler versions 2.4.x - 2.6.x. An attacker can exploit this vulnerability by logging into the Cobbler WebUI, creating a new profile with a Kickstart value of /etc/passwd, and then viewing the Kickstart value. This will allow the attacker to view the contents of the /etc/passwd file.

Mitigation:

Upgrade to the latest version of Cobbler.

Source

Exploit-DB raw data:

# Exploit Title: Local File Inclusion vulnerability in cobbler

# Exploit author: Dolev Farhi @f1nhack

# Date 07/05/2014

# Vendor homepage: http://www.cobblerd.org

# Affected Software version: 2.4.x - 2.6.x

# Alerted vendor: 7.5.14


Software Description
=====================
Cobbler is a Linux installation server that allows for rapid setup of network installation environments. It glues together and automates many associated Linux tasks so you do not have to hop between many various commands and applications when deploying new systems, and, in some cases, changing existing ones.
Cobbler can help with provisioning, managing DNS and DHCP, package updates, power management, configuration management orchestration, and much more.



Vulnerability Description
=========================
Local file inclusion


Steps to reproduce / PoC:
=========================
1.1. Login to Cobbler WebUI: http://ip.add.re.ss/cobbler_web/

1.2. Under Profiles -> Create New Profile

1.3. Create a new profile with some name, assign a distribution to it.

1.4: in Kickstart value, enter /etc/passwd
	
1.5. Save the profile

1.6. Navigate again to Profiles page

1.7. press on "View Kickstart" next to the new profile created.

1.8. /etc/passwd content is shown.


  <-> PoC Video: https://www.youtube.com/watch?v=vuBaoQUFEYQ&feature=youtu.be