CVE-2017-9386

Vulnerability

An issue exists in the get_file.sh script on Vera VeraEdge version 1.7.19 and Veralite version 1.7.481. The script is intended to retrieve files from the /cmh-ext folder, but the filename parameter is not validated. This allows an attacker to perform directory traversal attacks outside the intended folder. Note that the attacker must first create the /cmh-ext folder on the device, which can be done without authentication [1].

Exploitation

An attacker with network access to the device can exploit this vulnerability by first creating the /cmh-ext folder on the device (e.g., via an unauthenticated command). Then, the attacker sends a request to get_file.sh with a crafted filename parameter containing directory traversal sequences (e.g., ../) to navigate outside /cmh-ext and read arbitrary files on the device [1].

Impact

Successful exploitation allows an unauthenticated attacker to read any file on the device, leading to information disclosure. This compromises the confidentiality of sensitive data stored on the device [1].

Mitigation

As of the publication date, no official patch has been disclosed in the available references. Users are advised to restrict network access to the device and monitor for firmware updates from the vendor [1].