full-disclosure - Limited directory traversal in NeroNET 1.2.0.2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20051102203449.6570d3bd.aluigi@autistici.org>
Date: Wed Nov  2 19:34:19 2005
From: aluigi at autistici.org (Luigi Auriemma)
Subject: Limited directory traversal in NeroNET 1.2.0.2


#######################################################################

                             Luigi Auriemma

Application:  NeroNET
              http://www.nero.com
Versions:     <= 1.2.0.2
Platforms:    Windows
Bug:          limited directory traversal
Exploitation: remote
Date:         02 Nov 2005
Author:       Luigi Auriemma
              e-mail: aluigi@...istici.org
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


NeroNET is a web server which allows Nero users to use a CD/DVD burner
remotely.


#######################################################################

======
2) Bug
======


The program is affected by a classical directory traversal bug which
can be exploited by anyone since the directories used as base for the
attack (www and status) are publics and do NOT require authorization.
Both slash and backslash and the relative HTTP encoded chars are
allowed.
The limitation of this bug is that only some file extensions are
allowed:

  nri, nrg, zip, dvi, rtf, ppt, pdf, mpe, mpeg, mpg, mov, qt, vob, avi,
  wav, mp3, bmp, tiff, tif, jpe, jpeg, jpg, gif, log, txt, sdp, css,
  js, html, htm

The check made by NeroNET is only on the beginning of the extension so
JSP or JSWHATYOUWANT are allowed extensions since JS is in the list.


#######################################################################

===========
3) The Code
===========


  http://host/www/..%2f..%5c../..../folder/file.txt


#######################################################################

======
4) Fix
======


No fix.
No reply from the vendor.


#######################################################################


--- 
Luigi Auriemma 
http://aluigi.altervista.org