Headwind MDM Web panel 5.22.1 is vulnerable to Directory Traversal.The application uses an API call tomove the uploaded temporary file to the file directory during the file upload process. This API callreceives two input parameters, such as path and localPath. The first onerefers to the temporary file with an absolute path without validatingit. Attackers may modify this API call by referring to arbitrary files.As a result, arbitrary files can be moved to the files directory and sothey can be downloaded.
Exploitation’s steps
Authentication: Required (a low-level user access is enough)
due the vulnerability CVE-2023-47316 even low-level users can access the file-management function
setting up an attacker proxy like burp to intercept and to modify outgoing HTTP requests
Adding a file with an arbitrary filename and content and intercepting the outgoing HTTP requests
The first request just uploads the file in binary format. It is not needed to modify it.
The second request (/rest/private/web-ui-files/move POST) is the one to be modified as this one moves the uploaded file from the temporary location to the files directory located under the web root. Attackers can modify the path parameter according to what they want to retrieve.
Moving the /etc/hosts file to the files directory