CVE-2017-16806
published 2017-11-13CVE-2017-16806: The Process function in RemoteTaskServer/WebServer/HttpServer.cs in Ulterius before 1.9.5.0 allows HTTP server directory traversal.
PriorityP275high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
EXPLOIT
EPSS
91.50%
99.8th percentile
The Process function in RemoteTaskServer/WebServer/HttpServer.cs in Ulterius before 1.9.5.0 allows HTTP server directory traversal.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ulterius | ulterius_server | — | — |
| ulterius | ulterius_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
yara↗
regex: root:.*:0:0: OR \[(font|extension|file)s\]
- →Detect directory traversal attempts using the '...' (triple-dot) traversal sequence in HTTP GET request paths, which is the specific bypass used by this vulnerability instead of the standard '../' sequence. ↗
- →Monitor HTTP GET requests to '/.../fileIndex.db' on Ulterius server ports; successful retrieval exposes a compressed index of every file on the system, enabling targeted follow-on file theft. ↗
- →Alert on HTTP 200 responses from Ulterius server (default port 22006) where the response body matches '/etc/passwd' content (root:.*:0:0:) or Windows win.ini section headers ([(font|extension|file)s]). ↗
- →The traversal path uses exactly nine '...' segments to escape to the filesystem root; signature-match on GET requests containing sequences of three or more consecutive '.../' path components targeting Ulterius server. ↗
- ·The traversal only works for files on the same drive letter as the Ulterius server installation; files on other drive letters are not reachable via this technique. ↗
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Ulterius Server < 1.9.5.0 - Directory Traversal
exploitdb·2017-11-13·CVSS 7.5
CVE-2017-16806 [HIGH] Ulterius Server < 1.9.5.0 - Directory Traversal
Ulterius Server < 1.9.5.0 - Directory Traversal
---
# Exploit Title: Ulterius Server < 1.9.5.0 Directory Traversal Arbitrary File Access
# Date: 11/13/2017
# Exploit Author: Rick Osgood
# Vendor Homepage: https://ulterius.io/
# Software Link: https://github.com/Ulterius/server/tree/0e4f2113da287aac88a8b4c5f8364a03685d393d
# Version: < 1.9.5.0
# Tested on: Windows Server 2012 R2
# CVE : CVE-2017-16806
#
# You can download almost any file that resides on the same drive letter as Ulterius server.
# Example: http://ulteriusURL:22006/.../.../.../.../.../.../.../.../.../windows/win.ini
#
# Unfortunately, you need to know the path to the file you want to download.
# Fortunately, Ulterius indexes every file on the system, and it's usually stored in the same place:
# http://ulteriusURL:2206/.../f
Metasploit
Ulterius Server File Download Vulnerability
metasploit
Ulterius Server File Download Vulnerability
Ulterius Server File Download Vulnerability
This module exploits a directory traversal vulnerability in Ulterius Server < v1.9.5.0 to download files from the affected host. A valid file path is needed to download a file. Fortunately, Ulterius indexes every file on the system, which can be stored in the following location: http://ulteriusURL:port/.../fileIndex.db. This module can download and parse the fileIndex.db file. There is also an option to download a file using a provided path.
Nuclei
Ulterius Server < 1.9.5.0 - Directory Traversal
nuclei·CVSS 7.5
CVE-2017-16806 [HIGH] Ulterius Server < 1.9.5.0 - Directory Traversal
Ulterius Server < 1.9.5.0 - Directory Traversal
Ulterius Server before 1.9.5.0 allows HTTP server directory traversal via the process function in RemoteTaskServer/WebServer/HttpServer.cs.
Template:
id: CVE-2017-16806
info:
name: Ulterius Server < 1.9.5.0 - Directory Traversal
author: geeknik
severity: high
description: Ulterius Server before 1.9.5.0 allows HTTP server directory traversal via the process function in RemoteTaskServer/WebServer/HttpServer.cs.
impact: |
An attacker can exploit this vulnerability to access sensitive files, potentially leading to unauthorized access, data leakage, or further compromise of the server.
remediation: |
Upgrade Ulterius Server to version 1.9.5.0 or later to mitigate the directory traversal vulnerability.
reference:
- https://www.exploit-db.com/ex
No writeups or analysis indexed.
2017-11-13
Published