DreamBox DM800 Arbitrary File Download Vulnerability

vendor:

Dreambox

by:

ShellVision

7.5

CVSS

HIGH

Arbitrary File Download

CWE

Product Name: Dreambox

Affected Version From: dm800 <= 1.6rc3

Affected Version To: dm800 <= 1.6rc3

Patch Exists: NO

Related CWE: N/A

CPE: o:dream_multimedia:dreambox_dm800

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2011

DreamBox DM800 Arbitrary File Download Vulnerability

Dreambox suffers from a file download vulnerability thru directory traversal with appending the '/' character in the HTTP GET method of the affected host address. The attacker can get to sensitive information like paid channel keys, usernames, passwords, config and plug-ins info, etc. By default, web application is running by root, so catch shadow is very easy.

Mitigation:

Ensure that the web application is not running as root and restrict access to sensitive files.

Source

Exploit-DB raw data:

# Exploit Title: [title]
# Date: [date]
# Author: [ShellVision]
# Version: [dm800 <= 1.6rc3]
# Tested on: [dm800 Release 4.6.0 2009-12-24]



DreamBox DM800 Arbitrary File Download Vulnerability
 
 
Vendor: Dream Multimedia GmbH
Product web page: http://www.dream-multimedia-tv.de
Affected version: DM800 (may affect others version)
 
Summary: The Dreambox is a series of Linux-powered
DVB satellite, terrestrial and cable digital television
receivers (set-top box).
 
Desc: Dreambox suffers from a file download vulnerability
thru directory traversal with appending the '/' character
in the HTTP GET method of the affected host address. The
attacker can get to sensitive information like paid channel
keys, usernames, passwords, config and plug-ins info, etc.

By default, web application is running by root, so catch shadow is
very easy
 
Tested on: 

Devicename:	dm800
Enigma Version:	2009-12-24-master
Image Version:	Release 4.6.0 2009-12-24
Frontprozessor Version:	VNone
Webinterface Version:	1.6rc3

 
Vulnerability discovered by: ShellVision Designer@ShellVision.com
ShellVision - www.shellvision.com
 
 20 Jun 2011
 
 
--------------------------------------------------------------------
 
http://target.com/file?file=/etc/shadow