Security Research
CVE-2021-39316 DZS Zoomsounds: Unauthenticated Arbitrary File Read
Thinking
2021-08-15
4 min read
Research Dossier
#Vulnerability Analysis#Code Audit#Web Security
The DZS Zoomsounds plugin has a download endpoint that reads whatever path the client passes, with no permission check — crafting ../../../wp-config.php is enough to read the database password.
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a4d4b6d4ade7253d06d61bf923572a6b8c253d117e8b63642be9ad8c68eaee7d4a02592bcdbd3155abcc6a953135deec61ed6729ad92ae056a76758bfc9dbe3a6985cd8b376b1515f7321ad5bb4a1f7d95360f9d95245883b6f57ee6d3bacd482d739730ea9f9b53830f586454bb479a164fde628c117285d742e0675a4edb289989f0d51764818baeb3a176f798772e5c29150a33b510ea0771bb5dcbf2e38628c31536a97ba25e4a2d6e137b6fde5a5a1ec268520c79842819daf1c9632ee1b4a61b018821c8b2c360fb658fc1c8feae2bfec0c6ca5d4fc7b770b4006f01912734e4944ad8131df22d117f5155300033adf1dacfee70ff8acc1e2e9283f05325469f5eab8871cc7a1b83da5cb7a6b409b7579d657e5899f165df0d75e587b0663692c92eb9855ae86de83ac56bfba85222c83dfb67e6beb4979cb9bca3d8b4d9bb094b51458891f20b5eefeccd05daf77f2334b5c72ef965f9cba9675b6d7fbaee3316cede9806a7644defabd64f01012dc9cb6bc3b8ee2074e2b75bd0344f58bedbdb72500ef9f7f29e73096f3f2372ff82ab1211f47dd4bbec003a5a24635bfe8db5a217d528ab407ec2ca1845882475c6183e36d7a8435fefcaf56b5c0b59e3c6c5d7a08ca0039b70c56e1e6a9d2aeaad2b3b38aae680b2f1fe457e7df27513879ffe17d90acdaf14ca4a94ac8d10cfc342322c40c09aefd1954a596ec75af430d4bc4fd1884cd84da918c39be844943b2974bdf0b0b578baaab26c487fe7704fca49012cb9140b0878dec50fb265287a04445c376e285be39c9e7fdabf1a38b77a79ec719de0acfa438d8f65813ae61cbd96a6f55caa92a7d543ecb81e647003cd3239475b83396b03cbf25d95d53dfa7d57a179f7e881664636033e80793f4b1534e297b6e90641afe5d781440138461b96f33a7c5bb70767c2992a2640e625f9ece29e16cf74c098ecafaf49a926b2557ee13157c635841bc6d0dcdd074027395a8103e5ce9533c9dec256b9c752390e7bc944443223f8c4d9420941511d8d211b2a410a6702e084f38f08760d17ca65339edb985286db2e7487cf900fc3e6e8755dee134dad6f6961c02615ce72a9ccbfe2fae15e1787e3d46d27a1be5f73c19d820a737f8040187c8af5b5b7657437f52cd66edea6eeba648785025f69c078555c9def5f1ced91d44c6d2fe89628237967a2eb06ccd268a75e186f2616de4c8df84b4ad6a6d7994c0adce409292d7746aa9cd73d78deed865d5f0a0fe793140c67033f3e3d2e520a502d41158a3a838d2c6989bb9609e54def1135dd5f3c9901d6fa81e9e4450c1987b0f647c7c03b124394705560e659983d7f764f4b3e38d7e71454837deb713669120b98f5e2530130dd578f57049e2cf52190b6de88a0322514c97d84a1986d695974f3e9ca403d02fd303aa716d14ada2f4eb60063062bbb915d29e1da7ec58dcdf7b9ffc34d957f14e80eda98e43b5af9fb022c5d363003a4fada5f7e8a1b02f0b7654fb6bca91ebc27a26d79a8a15c659c282a28812a153ab11f7d9c823f7d9e287c1b6458e39078009228db5928fb816e17beac18f933f19fa5ab299f968d093d48383edece37f3b3d6710833340647d3108f8b0577db60655fadb3aa7dda94bb25df8e3cb5fb77aa7dfdf603904a885423cbceb25c9aa0b75e1dd5ce60bcf9a7f0934ef8597195e57eb329e5cddb8a555eaf1b51a5bb6f1fd919b176c68250b94be976f6265f42c9cb0e355566147827a72c3bee06e861d46594a6227e26e49fdbf7542a0e3c23b51b456dacc87498ed3f0cab93aee5e796d2c0c98256dddbf03308b2ba3994ec351f20c834ccd61b12e856854178ff04b8f34ed8331f5c448bbbd401ff0c19175a2f162082e15f2262a80f26147972e8a7e556257f2128c65d913c0fbb0ab4f2061e4a07e86f969e97669c812764cb9094832e598b57abd3e093e9b05d03c1239bd62117e2d9c52cba0f5778e40679599103df3b92107c74df623fe280dafa58d1c0111914f9f888e0a89d65913697241499960e3ad9036fad698fa3de3f665f6eaa6e0f6a0c2f3d86f6d570414d3c0d7e486f98d2134c2b1d8691dd3988307d4024b51d76bccb5920a12827310089424b564381a2b8a169115edf050083ea043f0c437e09ea641d3dcf08df03f7b746a07756078b831ad62737e1ca87daba0af8b392e354ea1972fb033f3e9e59357ab1555e9db8a18f5c3f9ce5c6a5eaa09f58f47e8fc0ccb8df60cf33b988a1bf0ea3306d77d4042789944d17607e6f980aeb7c71e1a0622af1c8c2e71a4b7e0f824ebbc77e3f39393a7683bf722ff8ad32fee83cc4672c597d50ed1a8fb46ba31e873cf9e9a466b369ecb42318322d4383d5312cc6b1be6fc79ab40124fea2c1f12e092fa759a8ce9bd41db4bdbd058471c2dde6e21f0726beac1e1c483b4387e2d5e88b6dda8673d936849ac556cd71a27b0c18db60e99876220292d4c634f85d142d36799c36f2227b0884264c010cff578c77784679230442ff1b1a73fb4b32147aeeb31b7fda3e3b9a720960c1b0cbaad37204a603c74fe4688783c216bc4cc8245d610ef355bb8aae7493eb1b73d6d5bf6e5ab6c876cac09ece4c5f53f41e981a72d5725a16342327fbdef4dd71e9bf233fc2ec2182995d4fe8c96a910d48a8b3fb45578fc9dbf3bce81b96647d096c0b7fecd835bb008b64bc4700a73ad2a52f8197c1dbf00d2fb4dd572087f04b32722b95203d3967aab0082369e7e883bdde220dc201dc830afd50b808f54b51700c05a5592ea6ad18c0c51347e4d48f4df2bfd74bf1f400496c76bc514ee3099604a2d31a2412d6e4adbbba8c04118a666a4c9f6031e50a725238b2a0293300811503c24995c204f411d96f951ed79400df6d2f9c360a64af14a1a7f25ccdc01601986156f18df56f8853c301c735fb1970d35717bfb617e3b9a657743b882669c931488bdd33cfc207d5e3351f3d8eefe17f7915ec02fda12f34b8fd352c713f5912a6bc81a81e550b03c75e33aa73955d875665acc3a7992d70faab25cd0c215b5b6e03584e0b0ae0f1d54bb4982ccf9861bb20f845a643f6ff6aecf591d16d753a1054e44c695cd2a3c91f35c59b39886a8bcd9216b5238061428ba16f11ced7cc3c71981998663004836118697c37ee99d9366d90dffb3d51900ea41c6d2331e99a388408ad93b79f1e52999807297e794297a1851f318ff4284bd7487e6e6592c1cbae1d3c5a55e20a5928b55a4d86b5f02409d5f741ee51ea3d5c7a44ab61af70512c4588b62662922567762e9f4941bac7860cb83ff965aaecbe667cde1c2911fac10a71f5c09d953a3e3e11d908eaa83a3ad18335e6042452ed17302547173e4d792a1ff3500b8ebd0003aa97fecfaed3a9bd19123234250da9e7e55d3609b266b8f5aa2edc7f7e76c36c56312a63f9d2bf8bc75cc250aab98309ae869c36d77d16e7cc084980f3ea5a45c647b6c1f8c92ac94819b51c892b738b436008df7160c2d7f9e7207b25d23bcfc0bb4bc55dcc8a8220765977be5c6fff4ab4546c8aca779a7a7c2e2cf5ae1a1444808bf2cb4f211f4bb4d3c005e0fa8da6f59b22f651f69ab2396ed859afee17aed3c2d9f779b5f81580ec7330cac6d5ea85fdf51a52867161ab788af3e6183a3effad3b52fbafe7d567342890dcc5f62c597d3dbd4f4d137e33ef7b9a23d5cfc8cc0b616330e7fc3934373cc7045167335da173e9f9f7deab98e33dcb0fb23777e8760a92a897dfde72adb5bebca363db2e9de0826582f57958fd38c06542fdf439d4679b0d626b281835fabaab7029920b3f3843d481365dead2396cdafa8569bf1195dcf5e7648f6bd617daab069ac87c50413a7b6d56cf38e25096611303e62fcf839d9cdae777669c36c13832dae8c345e15100b891f96b3082a95d6b53c9113235e12353680e388472dac3da1c83de8c17d240c9ee2644b679eb5d95e5af0efa243f6a0ddecc00687b8691fb44c8ddccb09fbea91c4011b5feea12ce4199bbc3cc5eec061a1c8f94049ea56aced1e5603482b8d1c652b7e5d6a8c683038f81db4a35826cc5e65792812f97179302b7f4305b1333cf9081d7316039d4e381236ece6869a713170da35d8d9997d12d0f557e2c4182c7df3bcd96f84f1dd40c760d97162141ca0ceae92c754d2642506e2d7bef38044120d701e41f06ce7a7af1bc82c01c54d6fdddb83dd3921cf5641adb5af535021cdb767ffe68b7082703d24eb5f54acff90e91743e0733316f7111760afc8cff0fd4c6ebc2d7ab08c288850dc48f891c0f3a8d8ab73012c38762f37aa5618d9c15038a5392be39ff95c3909feae4578d2b758af450ca17d794d99c17bf266afab9c0fe062e96bd52f905f64f3f2fa563f323c3cb8b835272a1ccde436bd4aabea36027f1a9c369c7e7f9c6d834d18b204ff9541b8b8a445b13fa68646ad03886e6e1ece5f1ae4d1e90425df015f8c19c9c460939490e63a13332e5ed7da9c27cd51ed223a2a2d5f6de79e79d8896bf87ece745a180f38f9170b3373a81f4eda7a29bc96efd4181f929b0a1717f242fe888fa444581195c8d9393b38c51bf0aa5bb931cf7375e06a7281ba4c8a6855c120443ee5442a148bce08a616af2f2f7987182b2ac5072cbb5475cce701dc85abe9b769ac3fc41ead01d3a72189542766f74a895c25293b312c99e861b60ecda506eae75c8b6e60de3b038e2d968d4f78b3793d89d9a2212827c0f38125e488f848e1df2f6a29584adde99316aa88e27a649676de88b14c18515dba914b00957e95a61542f761a3b6b7f6ba2b8c17634ee3e2f85100238173996ee986c88e94aa8180e7f9ce81eab9644ad2f9d495b314ca2c8f695b24041ea56dead4bf85c679783dac4394da0db993889c5463f5b460204b49be4ac5d7f1f2224fdd87c45528ef7ebc7eb7d883908c5a6d654180e7235ae88329c053957069435932601a340904ae90c6dea2baabaa6c0b0660aa8d710e1280fcccc60a5114e97d6e97cb402390cd175d29ddd488c8c3a0fc8ebe404dc18cc6c23aef2666f1d30d30182717c5a3099ad663e90aff1a45c41831995b4169302e4857fd50ca435c1a2cf6153e01c1cf1f304ef3cdfb386eb9c597582a722f6c60e42db2b85f2c422599b88626034c1de00ab867311521768482200716c059ace9480e160dec6304a9a4b586a72c4cec619c9bc7ab5d07868ebf936a0c6b65c4c90cb470561ad8e85b2f9bc87f00192abd1290319ba78f785bafe0d7897638c822395075cc848a026bc077f27846fb332a0cbe1cabc60dd91e5cfbe6760e3b87ac6e1c0a9a9fc87add2d6f65391e458d6546782f901093e0a4fd97fea8b51997651264629636d449d7934eefb611a0c0434819ac8d915977a1b76e29706478656cba79771e7730e15e3e22b63a2f5f46260589ca85809a0d5037510d0fe456407cf86d4757b7816405f0a577205b5b588a39f20718417443cd60fadafcfeeba6d2045a833176d6c9ba084d734f35e68c92948b4ca00753027b580db63b5d5f3f68a9d882eb8607cb03172e561c4db9150c8b256983c72ac0f85ecdb9efb78534cec9ae9c0104762f499427d8f2a754316e7a37385b1961fa07ec7b0654a57ae227449d3cd313fa76c968c31387d335fe7508b915a291e1a9d8a7ad6ce70fe8142cd72775318c8fa3740c5ddc30a39b9f9ad323f636c8d8226d96cc424b609f32ed3b7434c043642764c10992f8022deb76427ca8db0ef8279d012a3297d6e04279ff370f563e522028947636424020ae979b295ebc3f6fef7fa37bbdd2c5673df5442fb4c392c279c4ebb9b8ece9101326a55c4c165256dda27783b66ee6feb119ac611eb5ba2bc769701c41b3498323b201c6d0fe215958f06f0cdf5b6d1c079215ae72360e346c67cea66cbf0845fb7686a1afa80ae980515c07f7ebde79d56224692de6cb39e6a94e98dc13bc1bd73910036b69f3c6c8eb29f8f0aab48703d8bb99865a501fd4e1384fea2952445beaa82c6404560565da28f1c88b0be4700f962c8d7951feb46bf8dfb856d943259622d7694e34d855e3da12194b0528bb37f819ff7b4cdc7c1b321ff0798f7bfe4c758ca425406003c1c649d82d2cd5dd53089e25d3159aca0a43a3d28e7d126d07fe7b88cb9d2a3538e9601d60414f8e806323a1455df799d9a09f25afe480117d8b7530d6291e18d65c992df931da07a59c3d06020ceae73d0c5330f4d6781e51ce1e8c732cd812d5304ce8bd4adec511750e175314809c72a7c2c46df4cef8381a3490d2ac1d2b3cab37399168ddf065da68a53fbbeabca14e05b3bb60f46a7eb27d2f22c501ec7f3222c4c888c727b4953c50aad64218325a06275b226541ad204d124a81236aaf53ba901a50196152f3b484fbebafdaf3221336e978ebc1dda7ceed7b1067d5350c624eb6ad2877e81eae2d65e86d74fd011a327eb86daf22acb8f945290920e0ad88022c8eb3024caa1a9af99fb14b5834a45d37677460d96f7e6e4c0229082081067eb5b449dccf30c8690038d6233cef780d8a8e3305037c1c8a39077512ec1a7eef1b4eaa1716861fc1d80e6b5967eb732686f63cb0161b8c13a54d8ea2af365926bff8d8a543e3b050bf76c07e02204776aeff7559cdc444bd40ff08bbd2d80d64a4e54b536247760d18dc393245dd0e63bad30466a880d585b54e4570fef8ed40fb739a0fd1fbafd0d03b12784293ac6e30e6d0099ed3e95864c0745310710f2a537961d0453c26773902144855762ac7af5deea5087d3912c80a3f13e898e7a3cafb8d8fc27a209dab84ff61b4b04c83428e8a75ac2aa3799f3975d3a73fcbb81f169846bc3c140349f45a573cdc1553d1a861f8d68812b3e7f4f9dd903463c344bf6ef96a695705935487897284afc4b6bd8f68069041134ae0dc4731f64c2a69e4dbb85c4345ed07749c572bf771518cfe60ef3ebcab2922f690776aabeaa6d3c3dea39f735d902285c9c423919086a189ce381e3b3b05664ee3559b737a3299ea2c09527312dec006aa4c9e51e1f7b7d3b20607b7b34777e059d8c29853cf89e59a782114022c27f4851464f207285f19833ffe2747552411bfe3789310e1a9950eb6903d3fd5d82f062a5265691d82f9207cf49131ddcd0467bba72544b3db75c34d157c169f040fca9ec0d0f366c5c99dbc2aba99dd1479ddf82cb8d9e77db712b814fc9302c14b233cf911f997accbd9346be22ae7f169347c6bafc5ea7e944580bd453b779216ac607fba961b8fb106c46b3f19d2ff15ddfe1c4e55534dc518c53afa35cf638d15d43c134e0d0484a7370f9d8e4a35ac1164eaf169c6900c9cb349965c693f14249a0bbbfb296fc24485ae0c2c3662b57aef3203bc647f0e52eae86448c8f1fdd40aac5beab0a7481301db2c7f3ef5182d2444eda85ce35c840cf93f895e95b3c3cf42238d2d16f6f0eb1fdcdd0d6ae5cf867f5731b742087e2cbc25c285f82bd3f748f9310de693db42c0fed111c39cd528c7512924fc09960a852e129045d3889113610f6872c8425a9c8c5b4420700e6bc973065a4c46eb0f3b88e289b374a2cb992e4060e587a27ea6d66568ec5ca5bc3c5eb47f999348c7d62a838f786cfe4ae938d594c9c1c185372b05b5dd8b3327181c97a1c38731dd5b60e5bc643e032e7b69436828c2583c6362851632d6bb0803970c38fba8f15f7c5517a643f7be28c66bca34bec7b9c04e6e721aef7ffc5c2096726e80040cb11d98ef6e65902f8797e528e142ab7a823f6a1cb71fab96942ea677e773825a9a6df7f25483b6d113e5d15a62703a2e34a93addc249f781a8a5a92b3b7cef60ef07d6c55ded98c84a7f53efc6bb9a8a2cc0c3e413868f5cfc634cbc4eb49acd03be3e6deac761c14db527d2e0eacaca4c0b9ed6b64e6930239ee68ef40fce8c56d3d0bb56561a808a969c126df6c32cbe2aa77d60f01101d8b08c9aa6f656e8598d702fcab27c80d6ccc51e82697864e14487fad76a27d9c18e16eb28fc591ab818a7c266cdea9b865a3caf09e6c43185ede91af54ed138ee43c87dc83dfb088e5c8fe20e904367dfbcd80ae156b7f448d78f4afface98b967b84f7c31b21054821cbc89657de10b7285a48646f07981fec99c53d30d4776552fe141acff12c7223cecf4a647ca13f4f621ae3dedaa0495b5f790c7e2e6d03b165fcec480afa518932738893b73ddab8ebd8635a364a577a2e3d2b405bc2297daf6f23aeca3d73ceabf5eae82205e620f5bcc0c39ed9b9c36e2e42558f9933ee542bf0c0cfc76f805353626115e73d5564c0f7b04e91dc8b00001bc5af981abb9689e98ad9ea1871d9f5d53d827de0d23890df31acc856e79f8818255c2512d8b6c0519d8f1771698dcfacd65a33d5b6cf08b0339adc846bb4fa7ccb0f6f855cb8607fb09ce73d6f920cb2954464cd5457fa5430989c36e9591d141e9b92f828897967b5cede3a5f38c368143dc5bfbfbf9252b0de6584d689d1637bd364ff2233ae14e11b82ce099a634f7afa4a03d5988ab57930134885a7d9c309f3b087b4909838d9b069e6f5c482e48250eb690ffc6e57d5e9fcf3b2527f1ba097fc76cbb39791ddbd69825bc7dad1120f2d7c00f9234a96248f6d1a486635640b0f2bc2c15b090e5b1492145320af05750ac7009553dcebd2f7b172fa4b6bb70f57830134603a99bd6676c6df560758a62ac47c43972f99cd89bb43490566676f6c7289c18321946f8bc38ccfdba133ae3eec6fcac206423614bc1f9c6273424ebc2b5c1e3ef4df161f682b0beb8ec26a34bb35e245f3eaefdd7dd4bf753aefcc9953b81033c0e91a5616370a769a6d33f6ab8e4db8f6dc8e5cdeaf99011a4d81e7e2ad06cc0e23e047e607e379be3011a99f949e54785f84578156302a1c3b1b458a83259ea20e679e9d285880dbd333241fa5199629745ebb4a61da23173920a1874d604503c87b293c1d49375e8a0b66ca620eeeff911c7a0c7d1b1dfa7681bccfccbfc8ec5e43820bbbfc3562333163f12b9a959472c3b7e824933722c2a5801f2ce9682c1269caf40d5ba0e72a657d88e4c0c136340154aef977942758b66dfbf035a6b7523e081d445e7e045e61cb645f5e83875b9cb6bb23a7b07411b854c0c104ffbdc53275d77ba48ffa4ba0141097aca697ff6b94aae0854ddcd7c69927df0b232c4ee271ae82674ce1d41580041d772f8a3b7ba965fd36cffdb8af036d3f2643c73cdc815a35f6cfdef4a7ce84beba1c73f7af319f60ad4c0c27c2b688211db26fce4edfcbf6d7deb74d9b75745947611f5787dd536d38d14ddc963b86f8c3dc052565d1076726491d2fb83790398f14760b72431c1849d5d904b3b8204815b07b7bfad4127e98e509643e1ba2072547d30149309deaee84af1c40b7fb86539dfc7c475b93fef97a3644955ec17fe24d97c6a58188e89bc321ba4135e40e0e678986d88bef57911457f323a366a03e7ad5f3427f18d99571969993662ba3e41ccc7b003b3a18244794488cb54c8aad2cb0102229c42f1af56c58b7de199aae5e14f3796ff987410b10c5db917c8f52af0320a1158179caceb12fa2aa36b7815a3b3da9189beaf0adf1973b3ebcb9c1dc8633cddf12c9dd3dea8bf5b1d326a91693d1c93a36362768642ae0bda98761470ce32258ef4d77160beb2a6a199349bb2a7b301465c7f74cf7d046d029d35fa1ed9584b2085e0bb6b0a48b5acd473b01833cd0f929cb4