CVE-2019-12276
published 2019-06-05CVE-2019-12276: A Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows remote, unauthenticated attackers to…
PriorityP183high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
53.71%
98.9th percentile
A Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows remote, unauthenticated attackers to retrieve arbitrary files on the web server via specially crafted LetsEncrypt/Index?fileName= HTTP requests. A patch for this issue was made on 2019-05-30 in GrandNode 4.40.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| grandnode | grandnode | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect unauthenticated GET requests to /LetsEncrypt/Index with a fileName parameter containing path traversal sequences or absolute paths (e.g., /etc/passwd, /etc/shadow, ../../../web.config, ../../../App_Data/Settings.txt). ↗
- →A 200 HTTP response to /LetsEncrypt/Index?fileName= with a non-zero Content-Length indicates successful file retrieval; a 500 response or body containing 'UnauthorizedAccessException' indicates an access-denied condition. ↗
- →No authentication is required to exploit this endpoint; alert on any external/untrusted source accessing /LetsEncrypt/Index with a fileName query parameter. ↗
- ·The vulnerability affects both Windows and Unix operating systems, so path traversal payloads may use either forward slashes or backslashes depending on the target OS. ↗
- ·The vulnerable code resides specifically in Controllers/LetsEncryptController.cs; patched versions were released on 2019-05-30 for GrandNode 4.40. ↗
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vulncheck7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-jf62-vqvf-vq54: A Path Traversal vulnerability in Controllers/LetsEncryptController
ghsa_unreviewed·2022-05-24
CVE-2019-12276 [HIGH] CWE-22 GHSA-jf62-vqvf-vq54: A Path Traversal vulnerability in Controllers/LetsEncryptController
A Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows remote, unauthenticated attackers to retrieve arbitrary files on the web server via specially crafted LetsEncrypt/Index?fileName= HTTP requests. A patch for this issue was made on 2019-05-30 in GrandNode 4.40.
VulnCheck
grandnode grandnode Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
vulncheck·2019·CVSS 7.5
CVE-2019-12276 [HIGH] grandnode grandnode Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
grandnode grandnode Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
A Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows remote, unauthenticated attackers to retrieve arbitrary files on the web server via specially crafted LetsEncrypt/Index?fileName= HTTP requests. A patch for this issue was made on 2019-05-30 in GrandNode 4.40.
Affected: grandnode grandnode
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-26&host_type=src&vulnerability=cve-2019-12276; https://dashboard.shad
No detection rules found.
Exploit-DB
GrandNode 4.40 - Path Traversal / Arbitrary File Download
exploitdb·2019-06-24·CVSS 7.5
CVE-2019-12276 [HIGH] GrandNode 4.40 - Path Traversal / Arbitrary File Download
GrandNode 4.40 - Path Traversal / Arbitrary File Download
---
# Exploit Title: GrandNode Path Traversal & Arbitrary File Download (Unauthenticated)
# Date: 06/23/3019
# Exploit Author: Corey Robinson (https://twitter.com/CRobSec)
# Vendor Homepage: https://grandnode.com/
# Software Link: https://github.com/grandnode/grandnode/archive/728ca1ea2f61aead7c8c443407096b0ef476e49e.zip
# Version: <= v4.40 (before 5/30/2019)
# Tested on: Ubuntu 18.04
# CVE: CVE-2019-12276
'''
CVE-2019-12276
A path traversal vulnerability in the LetsEncryptController allows remote unauthenticated users to
view any files that the application has read/view permissions to. This vulnerability affects
Windows and Unix operating systems.
For more details, see: https://security401.com/grandnode-path-traversal/
'''
i
Nuclei
GrandNode 4.40 - Local File Inclusion
nuclei·CVSS 7.5
CVE-2019-12276 [HIGH] GrandNode 4.40 - Local File Inclusion
GrandNode 4.40 - Local File Inclusion
GrandNode 4.40 is susceptible to local file inclusion in Controllers/LetsEncryptController.cs, which allows remote unauthenticated attackers to retrieve arbitrary files on the web server via specially crafted LetsEncrypt/Index?fileName= HTTP requests.
Template:
id: CVE-2019-12276
info:
name: GrandNode 4.40 - Local File Inclusion
author: daffainfo
severity: high
description: |
GrandNode 4.40 is susceptible to local file inclusion in Controllers/LetsEncryptController.cs, which allows remote unauthenticated attackers to retrieve arbitrary files on the web server via specially crafted LetsEncrypt/Index?fileName= HTTP requests.
impact: |
Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information, remote code e
No writeups or analysis indexed.
http://packetstormsecurity.com/files/153373/GrandNode-4.40-Path-Traversal-File-Download.htmlhttps://github.com/grandnode/grandnodehttps://grandnode.comhttp://packetstormsecurity.com/files/153373/GrandNode-4.40-Path-Traversal-File-Download.htmlhttps://github.com/grandnode/grandnodehttps://grandnode.com
2019-06-05
Published
Exploited in the wild