CVE-2019-12276

HIGHNuclei

grandnode grandnode Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Title source: VulnCheck
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2019-12276 has a selected CVSS score of 7.5 (high); EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

A Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows remote, unauthenticated attackers to retrieve arbitrary files on the web server via specially crafted LetsEncrypt/Index?fileName= HTTP requests. A patch for this issue was made on 2019-05-30 in GrandNode 4.40.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Nov 26, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Catalogued exploits
1
Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

grandnode

Browse grandnode / grandnode
VulnCheckVersion data not supplied

Proofs of concept

1

Catalogued exploits

ExploitDBGrandNode 4.40 - Path Traversal / Arbitrary File DownloadExploitDB exploitby Corey RobinsonNot analyzed1 file
ExploitDB
PoC details

Nuclei templates

1
ProjectDiscoveryHIGHGrandNode 4.40 - Local File InclusionCVSS 7.5

GrandNode 4.40 is susceptible to local file inclusion in Controllers/LetsEncryptController.cs, which allows remote unauthenticated attackers to retrieve arbitrary files on the web server via specially crafted LetsEncrypt/Index?fileName= HTTP requests.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information, remote code execution, and potential compromise of the entire system.

Remediation

A patch for this issue was made on 2019-05-30 in GrandNode 4.40.

WeaknessesCWE-22
Authorsdaffainfo
Template tagscvecve2019packetstormlfigrandnodevkevvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:grandnode:grandnode:4.40:*:*:*:*:*:*:*
https://security401.com/grandnode-path-traversal/ https://grandnode.com/ https://github.com/grandnode/grandnode https://nvd.nist.gov/vuln/detail/CVE-2019-12276 http://packetstormsecurity.com/files/153373/GrandNode-4.40-Path-Traversal-File-Download.html

Source: ProjectDiscovery

References

4