EFS Web Server 7.2 Authentication Bypass

vendor:

Easy File Sharing Web Server

by:

Touhid M.Shaikh

8,8

CVSS

HIGH

Authentication Bypass

287

CWE

Product Name: Easy File Sharing Web Server

Affected Version From: 7.2

Affected Version To: 7.2

Patch Exists: NO

Related CWE: N/A

CPE: a:efs_software:easy_file_sharing_web_server

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2017

EFS Web Server 7.2 Authentication Bypass

Easy File Sharing Web Server is a file sharing software that allows visitors to upload/download files easily through a Web Browser. An attacker can bypass the login screen by changing the URL and browsing the drives. The attacker can then view drives and folders and download files from different drives or folders.

Mitigation:

Ensure that authentication is properly implemented and enforced.

Source

Exploit-DB raw data:

# Exploit Title: EFS Web Server 7.2 Authentication Bypass
# Date: 11-06-2017
# Software Link: http://www.sharing-file.com/efssetup.exe
# Software Version : 7.2
# Exploit Author: Touhid M.Shaikh
# Contact: http://twitter.com/touhidshaikh22
# Website: http://touhidshaikh.com/


######## Description ########
<!--
    What is Easy File Sharing Web Server 7.2 ?
    Easy File Sharing Web Server is a file sharing software that allows
visitors to upload/download files easily through a Web Browser. It can help
you share files with your friends and colleagues. They can download files
from your computer or upload files from theirs.They will not be required to
install this software or any other software because an internet browser is
enough. Easy File Sharing Web Server also provides a Bulletin Board System
(Forum). It allows remote users to post messages and files to the forum.
The Secure Edition adds support for SSL encryption that helps protect
businesses against site spoofing and data corruption.
-->

######## Video PoC and Article ########

https://www.youtube.com/watch?v=XlTH7Fm1m1w
http://touhidshaikh.com/blog/poc/EFSwebservr-authbypass/



######## Attact Description  ########
<!--

 Note: No Need to Login...bcz this is auth bypass vulnerability .hehehe.

==>START<==
Any visitor..

We can Bypass the Login Screen by just Change the URL and Browse the
Drives.
bingoo...
-->

######## Proof of Concept ########

When we visit the EFS web server its prompt for login, now attacker just
change url to below.
Exploit....

http://192.168.1.14/disk_c/

in this case change drvie by just change /disk_c to /disk_<Drive latter>
example. /disk_d , /disk_f etc

=============================================
NOTE :: ::
Now We have Permission to View Drives and Folder and Download Files. in
Diffrent Drives or folder.
============================================

 _____ ___  _   _ _   _ ___ ____
|_   _/ _ \| | | | | | |_ _|  _ \
  | || | | | | | | |_| || || | | |
  | || |_| | |_| |  _  || || |_| |
  |_| \___/ \___/|_| |_|___|____/

Touhid Shaikh.......