CVE-2021-20114
📋 TL;DR
This vulnerability allows unauthenticated attackers to access sensitive database backup files in TCExam installations. It affects all TCExam installations using default or recommended settings, potentially exposing user data, credentials, and other sensitive information.
💻 Affected Systems
- TCExam
📦 What is this software?
Tcexam by Tecnick
⚠️ Risk & Real-World Impact
Worst Case
Attackers download database backups containing user credentials, personal data, and exam content, leading to complete data breach and potential credential reuse attacks.
Likely Case
Unauthenticated users access and download database backup files containing sensitive information like user credentials and exam data.
If Mitigated
With proper access controls, the backup directory is inaccessible to unauthenticated users, preventing data exposure.
🎯 Exploit Status
Exploitation requires only web browser or curl command to access directory path.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 14.8.2
Vendor Advisory: https://github.com/tecnickcom/tcexam/releases
Restart Required: No
Instructions:
1. Download TCExam 14.8.2 or later from official repository. 2. Replace existing installation files with new version. 3. Verify /cache/backup/ directory has proper access controls.
🔧 Temporary Workarounds
Restrict directory access
allAdd .htaccess file to block access to /cache/backup/ directory
echo 'Deny from all' > /path/to/tcexam/cache/backup/.htaccess
Move backup directory
linuxRelocate backup directory outside web root
mv /path/to/tcexam/cache/backup/ /new/secure/location/
ln -s /new/secure/location/ /path/to/tcexam/cache/backup/
🧯 If You Can't Patch
- Implement web server rules to block access to /cache/backup/ directory
- Regularly delete old backup files and store them in secure location
🔍 How to Verify
Check if Vulnerable:
Attempt to access http://your-tcexam-url/cache/backup/ in browser or using curl. If directory listing or files are accessible, system is vulnerable.Check Version:
Check TCExam version in admin panel or examine tcexam/CODE/version.php fileVerify Fix Applied:
Attempt same access after fix. Should receive 403 Forbidden or similar access denied error.📡 Detection & Monitoring
Log Indicators:
- Multiple 200 OK responses to /cache/backup/ paths from unauthenticated IPs
- Large file downloads from backup directory
Network Indicators:
- HTTP GET requests to /cache/backup/*.sql or /cache/backup/*.gz from external IPs
SIEM Query:
source="web_logs" AND (uri_path="/cache/backup/" OR uri_path="/cache/backup/*") AND http_status=200 AND user_agent!="internal_monitor"