Meinberg LANTIME Web Configuration Utility 6.16.008 Arbitrary File Upload

Meinberg LANTIME Web Configuration Utility version 6.16.008 suffers from an arbitrary file upload vulnerability.


MD5 | cea75b62b1121f93f0200e9c1039ce2e

Title: Meinberg LANTIME Web Configuration Utility - Arbitrary File Upload
(Path Traversal)
Author: Jakub Palaczynski
CVE: CVE-2017-16788


Exploit was tested on:
======================

Meinberg LANTIME Web Configuration Utility 6.16.008


Vulnerability affects:
======================
All LTOS6 firmware releases before 6.24.004


Vulnerability:
**************

Arbitrary File Upload (Path Traversal):
=======================================

It is possible to upload any file to any location on the server.

Proof of Concept:
"Upload Groupkey" functionality allows for uploading any file to any
location on the server. An attacker may use path traversal to store files
in for example cron.d directory and execute them automatically to get root
access on the system.
This vulnerability allows for getting root access on the system from
Admin-User access.

Contact:
========

Jakub[dot]Palaczynski[at]gmail[dot]com



Related Posts

Comments