full-disclosure - Limited upload directory traversal in HTTP File Server 2.2a / 2.3 beta (build #146)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20071207230142.bf4f3a16.aluigi@autistici.org>
Date: Fri, 7 Dec 2007 23:01:42 +0100
From: Luigi Auriemma <aluigi@...istici.org>
To: bugtraq@...urityfocus.com, bugs@...uritytracker.com,
	news@...uriteam.com, full-disclosure@...ts.grok.org.uk, vuln@...unia.com,
	packet@...ketstormsecurity.org
Subject: Limited upload directory traversal in HTTP File
 Server 2.2a / 2.3 beta (build #146)

#######################################################################

                             Luigi Auriemma

Application:  HTTP File Server
              http://www.rejetto.com/hfs/
Versions:     <= 2.2a and <= 2.3 beta (build #146)
Platforms:    Windows
Bug:          limited directory traversal in files uploading
Exploitation: remote
Date:         05 Dec 2007
Author:       Luigi Auriemma
              e-mail: aluigi@...istici.org
              web:    aluigi.org

#######################################################################

1) Introduction
2) Bug
3) The Code
4) Fix

#######################################################################

===============
1) Introduction
===============

HFS is a very nice and small file server for Windows easy to use and
with many interesting features.

#######################################################################

======
2) Bug
======

HFS allows the uploading of files to the real folders added to the
Virtual File System.
The problem is that an attacker can upload files outside the
destination folder reaching the root or any other directory on the disk
in which is located the upload folder using the ../ pattern.

Note that uploading must be enabled on the target folder, that the
attacker must have access to it (is possible to restrict the access to
that folder to a specific account) and that is not possible to
overwrite existing files because the server avoids it (for example if a
file called file.txt already exists the new one will be called
file(1).txt).

#######################################################################

===========
3) The Code
===========

http://aluigi.org/testz/myhttpup.zip

  myhttpup http://SERVER/folder file.txt ../../../file.txt

#######################################################################

======
4) Fix
======

2.2b #150 and 2.3 beta #160

#######################################################################

--- 
Luigi Auriemma
http://aluigi.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/