CVE-2017-9833 BOA Web Server FILECAMERA Variable Arbitrary File Access Vulnerability

Boa is a single-tasking, high-performance Web server for Unix-based systems.
The vulnerability allows the injection of "../.." using the FILECAMERA variable sent by GET to read files with root privileges.

Affected version:
BOA Webserver 0.94.14rc21. Other versions may also be affected.

QID Detection Logic (Unauthenticated):
This QID matches data from etc/passwd file in the response it receives by sending a crafted HTTP GET request to target.

Successful exploitation can lead to a information disclosure vulnerability.

The vendor has not confirmed the vulnerability and no patch information is available at this time. Check Boa's Web site for the latest information.