CVE-2016-20104: EyeLock nano NXT 3.05.1193 Path Traversal via logdownload.php
EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the 'path' parameter. Attackers can send GET requests to /scripts/logdownload.php with traversal sequences like ../../etc/passwd, which readfile() returns unvalidated, disclosing local system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
No authentication, credentials, or user interaction is required. An attacker can send a GET request to the affected log download endpoint and supply traversal sequences in the path parameter.
What is the impact of successful exploitation?
Successful exploitation allows reading arbitrary local files that the web service can access. The stated impact is confidentiality loss; integrity and availability impacts are not identified.
Which versions are identified as affected?
The affected versions listed are EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646.
How can defenders check for exploitation attempts?
Review web server or application logs for GET requests to /scripts/logdownload.php where the path parameter contains directory-traversal sequences, such as ../../etc/passwd. Exploitation evidence was first observed on 2023-10-19.