full-disclosure - Source Code Disclosure in Yaws Webserver <1.56

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1292.83.65.90.98.1118993159.squirrel@www.sec-consult.com>
Date: Fri Jun 17 08:26:09 2005
From: research at sec-consult.com (Daniel Fabian)
Subject: Source Code Disclosure in Yaws Webserver <1.56

SEC-CONSULT Security Advisory < 20050616-0 >
=======================================================================
                  title: Source Code Disclosure in Yaws Webserver
                program: Yaws Webserver
     vulnerable version: 1.55 and earlier
               homepage: http://yaws.hyber.org
                  found: 2005-06-01
                     by: M. Eiszner / SEC-CONSULT / www.sec-consult.com
=======================================================================

vendor description:
---------------

Yaws is a HTTP high perfomance 1.1 webserver. Two separate modes of
operations are supported:
    * Standalone mode where Yaws runs as a regular webserver daemon.
      This is the default mode.
    * Embedded mode where Yaws runs as an embedded webserver in another
      erlang application.

Yaws is entirely written in Erlang furthermore it is a multithreaded
webserver where one Erlang light weight process is used to handle each
client.

vulnerabilty overview:
---------------

If a null byte is appended to the filename of a yaws script (.yaws), the
yaws webserver returns a page containing the source code of the
according script. This flaw allows a malicious attacker to analyse the
source code of the entire web application, which might result in the
attacker gaining sensitiv information like passwords.

proof of concept:
---------------

The yaws homepage itself was vulnerable to the attack. Opening the link
http://yaws.hyber.org/dynamic.yaws%00 in a browser resulted in the
display of the following code (only the first couple of lines...):

--- code ---
<erl>

box(Str) ->
    {'div',[{class,"box"}],
     {pre, [], yaws_api:htmlize(Str)}}.

tbox(T) ->
    box(lists:flatten(io_lib:format("~p",[T]))).

...
--- /code ---

vulnerable versions:
---------------

It seems that version 1.55 as well as all prior versions are vulnerable
to the attack described above.

vendor status:
---------------
vendor notified: 2005-06-16
vendor response: 2005-06-16
patch available: 2005-06-16

Vendor was extremly fast to response and post a fix. This is what
vendor vulnerability management should be like!

Download Patch from: http://yaws.hyber.org/yaws-1.55_to_1.56.patch

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Unternehmensberatung GmbH

Office Vienna
Blindengasse 3
A-1080 Wien
Austria

Tel.: +43 / 1 / 409 0307 - 570
Fax.: +43 / 1 / 409 0307 - 590
Mail: office at sec-consult dot com
www.sec-consult.com

EOF Daniel Fabian / @2005
d.fabian at sec-consult dot com