lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20060809155319.30734.qmail@securityfocus.com>
Date: 9 Aug 2006 15:53:19 -0000
From: c.boulton@...board.com
To: bugtraq@...urityfocus.com
Subject: XennoBB <= "avatar gallery" Directory Transversal

--------------------- SUMMARY ---------------------



Name:

	XennoBB "avatar gallery" directory transversal (10/8/2006)



Vendor / Product:

	XennoBB Group

	http://www.xennobb.com/

	

	Description:

	The world's most revolutionary and easy to use bulletin board.



	Revolutionary because it redefines the boundaries of usability

	and power; from the first version it's a real alternative to

	the commercial forums out there.



	How can XennoBB be described in few words? 

	Lightning-speed, stable, SECURED(?) and modern.

	

Version(s) Affected:

	<= 2.1.0

	

Severity:

	Medium

	

Impact:

	Directory transversal (Remote)



Status:

	Unpatched

	

Discovered by:

	Chris Boulton <http://www.surfionline.com>

	

Original advisory:

	http://www.surfionline.com/security_advisories/20060810_xennobb_avatar_gallery_transversal.txt

	

------------------- DESCRIPTION -------------------



An exploit exists in the above mentioned versions of XennoBB which

can be exploited by malicious users to transverse various directories

on the server.



Input passed to the "gallery" parameter in profile.php is not properly

sanitized before being used to open the corresponding directory on the

file system. This exploit can lead to manipulation of content in higher

up directories than the script intends.



--------------------- EXPLOIT ---------------------



Submit a forged POST request to



profile.php?action=avatar_gallery&id={your registered user ID here}



With the following as the POST data:



category=../../general/



Successful exploitation leads to images in the /img/general folder

being shown to the user. A similar process can be used to obtain other

confidential system documents or images which may exist on the server.



--------------------- SOLUTION --------------------



Ensure input is correctly sanitized and invalid/not acceptable

characters are removed from the gallery POST variable before the

directory is opened on the server.

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ