Bookeen Notea - Directory Traversal

vendor:

Bookeen Notea

by:

Clement MAILLIOUX

8.8

CVSS

HIGH

Directory Traversal

CWE

Product Name: Bookeen Notea

Affected Version From: BK_R_1.0.5_20210608

Affected Version To: BK_R_1.0.5_20210608

Patch Exists: YES

Related CWE: CVE 2021-45783

CPE: a:bookeen:bookeen_notea

Metasploit:

Other Scripts:

Platforms Tested: Android 8.1

2021

Bookeen Notea – Directory Traversal

The affected version of the Bookeen Notea System Update is prone to directory traversal vulnerability related to its note Export function. The vulnerability can be triggered by creating a note or using an existing note on the device, renaming it to '../../../../../../', and then selecting 'export' and 'View' from the menu that appears. This allows access and exploration of the device filesystem.

Mitigation:

Ensure that the system is updated to the latest version of the Bookeen Notea System Update.

Source

Exploit-DB raw data:

# Exploit Title: Bookeen Notea - Directory Traversal
# Date: December 2021
# Exploit Author: Clement MAILLIOUX
# Vendor Homepage: https://bookeen.com/
# Software Link: N/A
# Version: BK_R_1.0.5_20210608
# Tested on: Bookeen Notea (Android 8.1)
# CVE : CVE 2021-45783

# The affected version of the Bookeen Notea System Update is prone to directory traversal vulnerability related to its note Export function.
# The vulnerability can be triggered like so : 
# - Create a note or use an existing note on the device
# - rename this note ../../../../../../
# - keep touching the note until a menu appears
# - touch to select "export"
# - touch "View"

# Now you can access and explore the device filesystem.