lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20040311124230.EA7A724210@chernobyl.investici.org>
Date: Thu, 11 Mar 2004 12:42:30 -0000
From: "Donato Ferrante" <fdonato@...istici.org>
To: <bugtraq@...urityfocus.com>
Subject: Multiple Vulnerabilities in PWS 0.2.2


                           Donato Ferrante


Application:  Pegasi Web Server (PWS)
              http://pws.sourceforge.net

Version:      0.2.2

Bugs:         Multiple Vulnerabilities

Author:       Donato Ferrante
              e-mail: fdonato@...istici.org
              web:    www.autistici.org/fdonato


xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

1. Description
2. The bugs
3. The code
4. The fix



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

----------------
1. Description:
----------------

Vendor's Description:

"Pegasi Web Server (PWS) is a multithreading Java Web server. It is
written by students at the PegasiLUG as a project for Networking."



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

-------------
2. The bugs:
-------------

[1] directory traversal bug: the program doesn't check for malicious
    patterns like "/../", so an attacker is able to navigate through
    the system simply using a browser.


[2] cross site scripting bug: the user input strings are not filtered
    and they will appear in the returned page.



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

-------------
3. The code:
-------------

To test the vulnerabilities:

[1]

http://[host]:8080/../../../../etc/passwd

or:

http://[host]:8080/../


[2]

http://[host]:8080/<script>alert("Test")</script>



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

------------
4. The fix:
------------

No fix.
The email addresses provided on the official website seem don't work.


If you want, you can use my following little patch, that should fix
the bugs for this version of Pegasi Web Server:

        ...
        ..
        .

( line: 30 of FileFinder.java ) FileFinder(String httpURIPath)
{

/* start of patch for [1] */


boolean done = false;

for(int z = 0; z < httpURIPath.length()-1; z++){
  if( httpURIPath.charAt(z) == '.' && httpURIPath.charAt(z+1) == '.'){
       this.status = -1;
       done = true;
  }
}

if( done == true ) return;


/* end of patch for [1] */

        .
        ..
        ...

                          - - - - -
        ...
        ..
        .

( line: 233 of Connection.java )

/* start of patch for [2] */


     case -1:    /* nothing found */
     {
       Misc.putSysMessage(0,"Requested file was NOT found.");
       output.outputError(404, " ");
       //before "output.outputError(404,httpURI);"
       break;
     }

     
/* end of patch for [2] */

      .
      ..
      ...



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx



Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ