bugtraq - cPassMan v1.82 Arbitrary File Download

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <C5C7C070941E463DA708C4468D3A6530@senseofsecurity.com.au>
Date: Fri, 15 Apr 2011 10:55:26 +1000
From: "Lists" <lists@...seofsecurity.com>
To: "Vupen" <team@...en.com>, "Securiteam" <news@...uriteam.com>,
	"Secunia" <vuln@...unia.com>,
	"packetstorm" <submissions@...ketstormsecurity.org>,
	"Offsec" <submit@...sec.com>, "NullByte" <submit@...lbyte.org.il>,
	"Milw0rm" <submit@...w0rm.com>,
	"Full Disclosure" <full-disclosure@...ts.grok.org.uk>,
	"CVE" <cve@...re.org>, "CERT US" <cert@...t.org>,
	"CERT Australia" <info@...t.gov.au>,
	"Bugtraq" <bugtraq@...urityfocus.com>,
	"AusCERT" <auscert@...cert.org.au>
Subject: cPassMan v1.82 Arbitrary File Download - SOS-11-004

Sense of Security - Security Advisory - SOS-11-004

Release Date.                  15-Apr-2011
Last Update.                   -
Vendor Notification Date.      7-Mar-2011
Product.                       Collaborative Passwords Manager (cPassMan)
Platform.                      Independent (PHP)
Affected versions.             1.82 (verified), and possibly others
Severity Rating.               Medium
Impact.                        Local file system access
Attack Vector.                 Remote without authentication
Solution Status.               Upgrade to v2.0, v1.x branch no longer 
updated
CVE reference.                 Not yet assigned

Details.
A vulnerability has been discovered in the Collaborative Passwords Manager
(cPassMan) web application that can be exploited to retrieve files from the
local host file system. The input passed to the component
"sources/downloadfile.php" via the "path" variable allows the retrieval of 
any
file on the local file system that the web server has access to. There is no
data validation or authorisation mechanisms present within this component.

Proof of Concept.
http://localhost/cpassman/sources/downloadfile.php?path=/etc/passwd

Solution.
The author (Nils Laumaille) has indicated that the v1.x branch of cPassMan
will no longer be updated, as he has rewritten the application and v2.0 is 
now
the recommended release.

Discovered by.
Kaan Kivilcim - Sense of Security Labs.

About us.
Sense of Security is a leading provider of information
security and risk management solutions. Our team has expert
skills in assessment and assurance, strategy and architecture,
and deployment through to ongoing management. We are
Australia's premier application penetration testing firm and
trusted IT security advisor to many of the country's largest
organisations.

Sense of Security Pty Ltd
Level 8, 66 King St
Sydney NSW 2000
AUSTRALIA
T: +61 (0)2 9290 4444
F: +61 (0)2 9290 4455
W: http://www.senseofsecurity.com.au
E: info@...seofsecurity.com.au
Twitter: @ITsecurityAU

The latest version of this advisory can be found at:
http://www.senseofsecurity.com.au/advisories/SOS-11-004.pdf

Other Sense of Security advisories can be found at:
http://www.senseofsecurity.com.au/research/it-security-advisories.php