Shenzhen Ruiming Technology Streamax Crocus Path Traversal Vulnerability in File Download Function

A path traversal vulnerability has been identified in Shenzhen Ruiming Technology's Streamax Crocus version 1.3.40. The issue arises in the 'Download' function of the 'DeviceFileReport.do' file, where manipulation of the 'FilePath' parameter allows for unauthorized access to files outside the intended directory. This vulnerability can be exploited remotely, and an exploit is publicly available.

Impact

Exploitation of this vulnerability allows for arbitrary file download, potentially leading to unauthorized access to sensitive files such as configuration or database files.

Reproduction

To reproduce this vulnerability, send a POST request to 'DeviceFileReport.do' with the 'Action' parameter set to 'Download' and the 'FilePath' parameter manipulated to traverse directories (e.g., using '../') to access files outside the intended directory. Include a forged 'Saffron.U' cookie to bypass authentication.