bugtraq - [KIS-2014-12] TestLink <= 1.9.12 (database.class.php) Path Disclosure Weakness

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <54496E80.105@karmainsecurity.com>
Date: Thu, 23 Oct 2014 23:09:20 +0200
From: Egidio Romano <research@...mainsecurity.com>
To: bugtraq@...urityfocus.com, fulldisclosure@...lists.org
Subject: [KIS-2014-12] TestLink <= 1.9.12 (database.class.php) Path Disclosure
 Weakness

----------------------------------------------------------------
TestLink <= 1.9.12 (database.class.php) Path Disclosure Weakness
----------------------------------------------------------------


[-] Software Link:

http://testlink.org/


[-] Affected Versions:

Version 1.9.12 and prior versions.


[-] Weakness Description:

The vulnerable code is located in the /lib/functions/database.class.php script:

208.	      if(defined('DBUG_ON') && DBUG_ON == 1)
209.	      {
210.	        echo "<pre>"; debug_print_backtrace(); echo "</pre>";
211.	      }
212.	      else
213.	      {
214.	        echo "<pre>"; debug_print_backtrace(DEBUG_BACKTRACE_IGNORE_ARGS); echo "</pre>";
215.	      }

The weakness exists due to this script reveals debug information generated by the "debug_print_backtrace()" function.
This can be exploited to gain knowledge of the web root directory by sending direct requests to certain scripts.


[-] Solution:

Update to version 1.9.13 when will be released or apply these hotfixes: http://mantis.testlink.org/view.php?id=6609


[-] Disclosure Timeline:

[06/10/2014] - Issue reported to http://mantis.testlink.org/view.php?id=6651
[07/10/2014] - Issue fixed in the Git repository: http://goo.gl/AnOAi6
[08/10/2014] - CVE number requested
[11/10/2014] - CVE number assigned
[23/10/2014] - Public disclosure


[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2014-8082 to this weakness.


[-] Credits:

Vulnerability discovered by Egidio Romano.


[-] Original Advisory:

http://karmainsecurity.com/KIS-2014-12