Hanming Video Conferencing Local File Inclusion Scanner

Hanming Video Conferencing is a software application used by businesses, educational institutions, and other organizations to facilitate virtual meetings and conferences. It is designed for typical use by professionals to collaborate in real-time regardless of their geographic locations. The software supports video calls, screen sharing, and file transfer, making it versatile for various use cases. It helps businesses maintain continuity and efficiency in operations. The platform is widely recognized for its user-friendly interface and high-quality video streaming. Due to its extensive use globally, it is critical to ensure its security and maintain user trust.

Local File Inclusion (LFI) is a vulnerability allowing attackers to include files residing on a server, which can then be executed. This vulnerability arises when an application does not validate or sanitize user input, allowing the retrieval of sensitive files. Exploiting LFI can lead to information leakage and potentially expand into further attacks such as Remote Code Execution. It's a significant risk vector, largely due to its potential to expose sensitive configuration files. The inclusion typically works by manipulating user inputs to reference unintended files. As server-side security measures vary, the severity of LFI exploitation can differ based on the server configuration and file permissions.

The vulnerability in Hanming Video Conferencing exists due to improper validation of the 'fileName' parameter in certain API endpoints. Attackers can exploit this by navigating directories to access unauthorized files such as 'win.ini' or '/etc/passwd'. The endpoints vulnerable to this attack include 'toDownload.do', which fails to check or sanitize input paths adequately. By including traversal patterns like '../../../../../../..', attackers successfully reach sensitive files. This lack of input validation is a common flaw that potentially compromises server confidentiality. The attack relies heavily on the assumption that the server has not implemented adequate defenses against directory traversal sequences.

Potential effects of this vulnerability include unauthorized access to sensitive server files that may contain configuration settings or credentials. An attacker gaining access to these files can understand the server environment more comprehensively, potentially leading to further exploitation such as privilege escalation. It might also expose sensitive information about the user accounts leading to significant information disclosure. The overall security posture of the server becomes compromised, posing a higher risk of additional attacks. Maintaining low security hygiene due to such vulnerabilities can damage the organization’s reputation and result in regulatory non-compliance.

REFERENCES

• https://mp.weixin.qq.com/s/F-M21PT0xn9QOuwoC8llKA