CVE-2021-33558
published 2021-05-27CVE-2021-33558: Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.html, preview.html, js/log.js, log.html…
PriorityP277high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
ITWEXPLOITVulnCheck KEVRansomware
Exploited in the wild
EPSS
10.33%
95.1th percentile
Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.html, preview.html, js/log.js, log.html, email.html, online-users.html, and config.js. NOTE: multiple third parties report that this is a site-specific issue because those files are not part of Boa.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| boa | boa | — | — |
Detection & IOCsextracted from sources · hover to see the quote
path/js/log.js
otherServer: Boa/0.94.13
- →HTTP GET request to /js/log.js returning HTTP 200 with body containing both 'function SearchLog' and 'logTime' (case-insensitive) indicates a vulnerable/misconfigured Boa 0.94.13 instance.
- →Fingerprint exposed Boa 0.94.13 servers via the HTTP response header 'Server: Boa/0.94.13' using Shodan or FOFA queries.
- →Unauthenticated HTTP GET to the enumerated paths (backup.html, preview.html, js/log.js, log.html, email.html, online-users.html, config.js) with a 200 response indicates information disclosure. ↗
- ·The vulnerable files (backup.html, preview.html, js/log.js, log.html, email.html, online-users.html, config.js) are NOT part of the Boa web server itself — this is a site-specific/device-vendor misconfiguration layered on top of Boa 0.94.13. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vulncheck7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8rj5-wwmx-vj53: Boa 0
ghsa_unreviewed·2022-05-24
CVE-2021-33558 [HIGH] CWE-200 GHSA-8rj5-wwmx-vj53: Boa 0
Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.html, preview.html, js/log.js, log.html, email.html, online-users.html, and config.js.
VulnCheck
boa boa Exposure of Sensitive Information to an Unauthorized Actor
vulncheck·2021·CVSS 7.5
CVE-2021-33558 [HIGH] boa boa Exposure of Sensitive Information to an Unauthorized Actor
boa boa Exposure of Sensitive Information to an Unauthorized Actor
Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.html, preview.html, js/log.js, log.html, email.html, online-users.html, and config.js. NOTE: multiple third parties report that this is a site-specific issue because those files are not part of Boa.
Affected: boa boa
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Known Ransomware Campaign Use: Known
Exploitation References: https://info.securin.io/hubfs/Securin%20Ransomware%20Report%202023.pdf; https://4502402.fs1.hubspotusercontent-na1.net/hubfs/4502402/Ransomware%20-%20Index%20Update%20Q1%202023.pdf; htt
No detection rules found.
Nuclei
Boa 0.94.13 - Information Disclosure
nuclei·CVSS 7.5
CVE-2021-33558 [HIGH] Boa 0.94.13 - Information Disclosure
Boa 0.94.13 - Information Disclosure
Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.html, preview.html, js/log.js, log.html, email.html, online-users.html, and config.js. NOTE- multiple third parties report that this is a site-specific issue because those files are not part of Boa.
Template:
id: CVE-2021-33558
info:
name: Boa 0.94.13 - Information Disclosure
author: DhiyaneshDK
severity: high
description: |
Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.html, preview.html, js/log.js, log.html, email.html, online-users.html, and config.js. NOTE- multiple third parties report that this is a site-specific issue because those files are not part of Boa.
impact: |
Unauthe
No writeups or analysis indexed.
https://github.com/mdanzaruddin/CVE-2021-33558.https://github.com/mdanzaruddin/CVE-2021-33558./issues/1https://sourceforge.net/projects/boa/files/boa/0.94.13/https://github.com/mdanzaruddin/CVE-2021-33558.https://github.com/mdanzaruddin/CVE-2021-33558./issues/1https://sourceforge.net/projects/boa/files/boa/0.94.13/
2021-05-27
Published
Exploited in the wild