vsm LTC TimeSync Unauthenticated Path Traversal (CVE-2024-6049)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name and ID: - Unauthenticated Path Traversal Vulnerability (CVE-2024-6049) 2. Vulnerability Description: - Unauthenticated Path Traversal Vulnerability (CVE-2024-6049): The web interface of vsm LTC Time Sync (vTimeSync) is vulnerable to a path traversal vulnerability. By sending a specially crafted HTTP request, an unauthenticated remote attacker can download arbitrary files from the vulnerable system. As a limitation, the exploitation is only possible if the requested file has a file extension, e.g., .exe or .txt. 3. Impact: - The web server is running with highest SYSTEM privileges by default, which enables an attacker to gain access to privileged files. 4. Exploitation: - Proof of concept: To exploit the vulnerability, it is sufficient to use the following curl command to send a request to the vulnerable web server: - For example, the following command can be used to request the default file win.ini: - If the application is running with SYSTEM privileges (default), the following command can be used to exfiltrate the PowerShell history of the Windows administrator, which might leak sensitive information: 5. Affected Versions: - The following version has been tested, which was the latest version available at the time of the test: - 4.4.12.0 - According to the vendor, versions before 4.5 are affected, and v4.5.6.0 includes the fixes. 6. Solution: - The vendor provides a patch in versions after v4.5, which can be downloaded from the following URL, such as version 4.5.6.0: 7. Workarounds: - None 8. Advisor URL: - sec-consult.com/vulnerability-lab/ 9. Disclosure Information: - EOF Sandro Einfeldt, Dennis Jung, Johannes Greil / @2024 This information provides detailed descriptions of the vulnerability, exploitation methods, affected versions, and remediation steps.

Goal Reached Thanks to every supporter — we hit 100%!

vsm LTC TimeSync Unauthenticated Path Traversal (CVE-2024-6049)