CVE-2017-6527
published 2017-03-09CVE-2017-6527: An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to a NUL-terminated directory traversal attack allowing an unauthenticated…
PriorityP271high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
EXPLOIT
EPSS
56.65%
98.9th percentile
An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to a NUL-terminated directory traversal attack allowing an unauthenticated attacker to access system files readable by the web server user (by using the viewAppletFsa.cgi seqID parameter).
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dnatools | dnalims | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor HTTP GET requests to viewAppletFsa.cgi where the seqID parameter contains null bytes (%00) and directory traversal sequences (e.g., ../) indicating a NUL-terminated path traversal attempt. ↗
- →Alert on unauthenticated POST requests to cgi-bin/dna/sysAdmin.cgi, which bypasses authentication and exposes a web shell running as the web server user. ↗
- →Flag any web server access to /home/dna/spool/.pfile via directory traversal through viewAppletFsa.cgi, as this file stores cleartext credentials for all dnaLIMS users. ↗
- →Detect session hijacking attempts against seqreq2N.cgi by monitoring for requests where the username parameter contains a mismatched or brute-forced four-digit UID with an arbitrary session prefix. ↗
- ·The directory traversal vulnerability in viewAppletFsa.cgi requires no authentication, meaning it is exploitable by any unauthenticated user on the internet without any prior access. ↗
- ·The Metasploit module references the parameter as 'secID' while the CVE and advisory reference it as 'seqID'; both refer to the same vulnerable parameter in viewAppletFsa.cgi. ↗
- ·Cleartext password storage in /home/dna/spool/.pfile is described as likely the default configuration, meaning most deployments are at risk of full credential compromise when chained with CVE-2017-6527. ↗
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
dnaLIMS DNA Sequencing - Directory Traversal / Session Hijacking / Cross-Site Scripting
exploitdb·2017-03-10·CVSS 9.8
CVE-2017-6529 [CRITICAL] dnaLIMS DNA Sequencing - Directory Traversal / Session Hijacking / Cross-Site Scripting
dnaLIMS DNA Sequencing - Directory Traversal / Session Hijacking / Cross-Site Scripting
---
Title: Multiple vulnerabilities discovered in dnaLIMS DNA sequencing
web-application
Advisory URL: https://www.shorebreaksecurity.com/blog/product-security-advisory-psa0002-dnalims/
Date published: Mar 08, 2017
Vendor: dnaTools, Inc.
CVE IDs: [2017-6526, 2017-6527, 2017-6528, 2017-6529]
USCERT VU: 929263
Vulnerability Summaries
1) Improperly protected web shell [CVE-2017-6526]
dnaLIMS requires authentication to view cgi-bin/dna/sysAdmin.cgi, which is
a web shell included with the software running as the web user. However,
sending a POST request to that page bypasses authentication checks,
including the UID parameter within the POST request.
2) Unauthenticated Directory Traversal [CVE-2017-6527]
Metasploit
DnaLIMS Directory Traversal
metasploit
DnaLIMS Directory Traversal
DnaLIMS Directory Traversal
This module exploits a directory traversal vulnerability found in dnaLIMS. Due to the way the viewAppletFsa.cgi script handles the 'secID' parameter, it is possible to read a file outside the www directory.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/96823https://www.exploit-db.com/exploits/41578/https://www.shorebreaksecurity.com/blog/product-security-advisory-psa0002-dnalims/http://www.securityfocus.com/bid/96823https://www.exploit-db.com/exploits/41578/https://www.shorebreaksecurity.com/blog/product-security-advisory-psa0002-dnalims/
2017-03-09
Published