0

I have a Raspberry Pi connected to my network and keep getting this vulnerability warning from my security software. I turned off the apache2 web server on the Pi, which fixed my port 80 issue but have no idea how to fix the remaining port issues (8080 and 8443 below). I need to fix these vulnerabilities without removing my SSH access. Is this easily fixed by adjusting permissions to files or do I need to do something else? My webpage code is written in HTML and PHP if that helps. The webpage is shutdown after it accomplishes its purpose but I am still vulnerable to traversal. How do I fix this? Thanks in advance.

PORT STATE SERVICE

22/tcp open ssh

8080/tcp open http-proxy

| http-passwd: Directory traversal found.

| Payload: "/../../../../../../../etc/passwd"

| Printing first 250 bytes:

8443/tcp open https-alt

| http-passwd: Directory traversal found.

| Payload: "/../../../../../../../etc/passwd"

| Printing first 250 bytes:

sudo netstat -lptu results are: enter image description here


NOTE: "dwcore" is deviceWISE M2M by Telit just adding some more info in case that helps

  • TO REMOVE "dwcore"

sudo /opt/dw/devicewise stop
sudo /bin/sh/etc/software/dwgateway_raspbian.remove
sudo rm -rf /opt/dw

  • I am using a raspberry pi. How can I check the application? Is there a linux command? – SChand Aug 21 at 17:33
  • @Ghedipunk I read PHP has some built in functions that can check input paths but also not sure how to use it and if this is even a solution for me – SChand Aug 21 at 17:34
  • The process name that you're looking for is dwcore. It's not an application that I'm familiar with, though it does narrow things down for those who may be able to help. I'll delete my comments up to this one, as they've served their purpose. – Ghedipunk Aug 21 at 20:14
  • @Ghedipunk how does knowing the application help prevent directory traversal? – SChand Aug 21 at 20:15
  • 1
    You security scanner is connecting to that application, and that application is what's allowing the directory traversal. It's likely misconfigured. A few Google searches for that process name has left me clueless on what that application is, so I can't help further. My advice is to find the documentation, or hopefully someone will read this question and know what dwcore is. – Ghedipunk Aug 21 at 20:21
3

This simply means that dwcore application which is listening on port 8080 and 8443 are vulnerable to path traversal. Without the knowledge of what that application is, an accurate answer cannot be provided for this.

Having said that, if the application running on those two ports are not used, you can kill those services or add an iptable rule to restrict access to those ports to prevent this.

If that application is needed to run, you will have to fix directory traversal at code level [if that is written by you and have the source available.]

Also to answer your following questions:

Is this easily fixed by adjusting permissions to files or do I need to do something else?

/etc/passwd is supposed to be read by all users on the machine. The issue here is not that it can be read, rather it can be retrieved by someone outside the raspberry pi by connecting to the web application running on port 8080 and 8443. In other words, this is not a permission issue, but an application security issue.

PS: From the question I read that you have created a web application in PHP to run on the raspberry pi, but it it is unclear at this point which port your application is listening on if you have disabled port 80.

  • 1
    Sorry, to clarify... the web app is written in PHP but after it achieves its purpose I turn off the app. Once the PHP script is exited I still get traversal vulnerabilities. I personally wouldn't know how to find the application running on those ports, it is also possible the security tool is accessing that port. How can I fix this at code level? I read some items mentioning filtering basepaths? I was just hoping someone with more background on this could provide an example or even a basic solution at code level ideally. – SChand Aug 21 at 22:39
  • @SChand, if that's the case, then it's definitely not in your PHP code. – Ghedipunk Aug 21 at 22:57
  • @Ghedipunk where would this code based traversal security go? what language is code like this written in? The goal of the question is to fix the traversal vulnerability – SChand Aug 21 at 23:09
  • 1
    @SChand, it's in the dwcore application installed on your RPi. So far, nobody knows what that is beyond its name. Maybe someone will come by with a better idea, but right now, you're the one with the most access to information on it, since you're the one with that application. If you want to stop that vulnerability, your options are to investigate further (we're unlikely to be able to help you with that), or remove that program and see what happens. (Be aware that bad things might happen if you remove that program. Until someone learns what dwcore is, we can't give you good advice.) – Ghedipunk Aug 21 at 23:17
  • Do I need to know the application? Isn't it possible to detect attacks on those ports without caring about the device/application attached to it? – SChand Aug 21 at 23:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.