CVE-2020-19360
📋 TL;DR
CVE-2020-19360 is a local file inclusion vulnerability in FHEM 6.0 that allows attackers to read arbitrary files on the server through the fhem/FileLog_logWrapper file parameter. This can lead to sensitive information disclosure including configuration files, passwords, and system data. Users running FHEM 6.0 are affected.
💻 Affected Systems
- FHEM
📦 What is this software?
Fhem by Fhem
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through reading sensitive files like /etc/passwd, SSH keys, or database credentials, potentially leading to privilege escalation or lateral movement.
Likely Case
Sensitive information disclosure including FHEM configuration files, logs, and potentially system files accessible to the web server user.
If Mitigated
Limited impact if proper file permissions restrict web server user access to sensitive files and network segmentation is in place.
🎯 Exploit Status
Proof of concept code is publicly available on GitHub. Exploitation requires sending specially crafted requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FHEM 6.1 and later
Vendor Advisory: https://forum.fhem.de/index.php/topic,115309.0.html
Restart Required: Yes
Instructions:
1. Backup current FHEM configuration. 2. Update to FHEM 6.1 or later version. 3. Restart FHEM service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Disable web interface
allTemporarily disable the FHEM web interface to prevent exploitation
# Edit FHEM config and comment out or remove web interface settings
# Restart FHEM: sudo systemctl restart fhem
Restrict network access
linuxConfigure firewall rules to restrict access to FHEM web interface
# Example iptables rule: sudo iptables -A INPUT -p tcp --dport 8083 -s trusted_ip -j ACCEPT
# Block all others: sudo iptables -A INPUT -p tcp --dport 8083 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit access to FHEM web interface
- Apply strict file permissions to sensitive system files and monitor for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check FHEM version: grep 'FHEM_VERSION' /opt/fhem/fhem.cfg or check web interface footer. If version is 6.0, system is vulnerable.Check Version:
grep 'FHEM_VERSION' /opt/fhem/fhem.cfg || cat /opt/fhem/fhem.pl | grep 'our \$FHEM_VERSION'Verify Fix Applied:
Verify FHEM version is 6.1 or later and test the vulnerable endpoint with known exploit payloads to confirm they no longer work.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in FHEM logs
- Requests to fhem/FileLog_logWrapper with file parameter containing path traversal sequences (../)
- Multiple failed file inclusion attempts
Network Indicators:
- HTTP requests to /fhem/FileLog_logWrapper with file parameter
- Unusual spikes in traffic to FHEM web interface
SIEM Query:
source="fhem.log" AND "FileLog_logWrapper" AND ("../" OR "file=" OR "path traversal")