bugtraq - [DCA-2011-0015] QuesCom Qportal User - OctoWebSvr/COM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAN6_2VYtcB+Ts0p38Hw9TL9SiZbzV30-w24PmvkQBwDJhcKpPw@mail.gmail.com>
Date: Thu, 8 Dec 2011 14:50:26 -0200
From: Ewerson Guimarães (Crash) - Dclabs <crash@...abs.com.br>
To: bugtraq@...urityfocus.com
Subject: [DCA-2011-0015] QuesCom Qportal User - OctoWebSvr/COM - Source Code Disclosure

[Discussion]
- DcLabs Security Research Group advises about the following vulnerability(ies):
[Software]
- QuesCom Qportal User
[Vendor Product Description]
- No vendor product description
- Site: http://www.quescom.com/
[Advisory Timeline]
- 12/01/2011 -> First Contact requesting security department contact;-
12/01/2011 -> Vendor reply .- 12/01/2011 -> Adv. sent to vendor.-
12/05/2011 -> Vendor reply .- 12/05/2011 -> Video sent to vendor .-
12/06/2011 -> Vendor reply .- 12/07/2011 -> Published

[Bug Summary]
-  Asp source code disclosure
[Impact]
- High
[Affected Version]
- Version:5.10.014
[Bug Description and Proof of Concept]
Attackers use source code disclosure attacks to try to obtain the
source code of server-side applications. The basic role of Web servers
is to serve files as requested by clients. Files can be static, such
as image and HTML files, or dynamic, such as ASP, JSP and PHP files.
When the browser requests a dynamic file, the Web server first
executes the file and then returns the result to the browser. Hence,
dynamic files are actually code executed on the Web server.
http://www.imperva.com/resources/glossary/source_code_disclosure.html


POC
http://server/remotefile.asp%20http://server/remotefile.asp::$DATA
Characters other than %20 and ::$DATE may also be used to disclose the
source code.
All flaws described here were discovered and researched by:
Ewerson Guimaraes aka CrashDcLabs Security Research Groupcrash (at)
dclabs <dot> com <dot> br
[Patch(s) / Workaround]
Version 6.21 fixes the issue.
[Greetz]DcLabs Security Research Group.
--
Ewerson Guimaraes (Crash)
Pentester/Researcher
DcLabs Security Team
www.dclabs.com.br