full-disclosure - Blue-Collar Productions iGallery 4.1 Plus Arbitrary File Download

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <4A266AAE.1080208@upyou.it>
Date: Wed, 03 Jun 2009 14:21:02 +0200
From: Stefano Angaran <stefano.angaran@...ou.it>
To: full-disclosure@...ts.grok.org.uk
Subject: Blue-Collar Productions iGallery 4.1 Plus
	Arbitrary File Download

Vendor Notified: 05/25/2009

Vulnerability Details:
-------------------------------------------
Blue Collar Productions iGallery 4.1 Plus ( 
http://www.b-cp.com/igallery/default.asp ) is a commercial photo gallery 
script written in Classic ASP. There exists also a free version
named iGallery 3.4. The file streamfile.asp suffers from an Arbitrary 
File Download vulnerability due to the missed input validation on the 
"i" and "f" parameters, in particular
no validation is done on path traversal patterns.

Systems Affected:
-------------------------------------------
iGallery 4.1 Plus and iGallery 3.4 were tested and shown to be vulnerable.

Impact:
-------------------------------------------
Through this vulnerability remote and unauthenticated users could 
download any file
accessible by the web server and by reading source files a malicious 
user could read
important information such as database passwords.

Mitigation Factors:
-------------------------------------------
New IIS installations are often configured to deny requests with ../ in 
the query string. Unfortunately
the injection can come also from POST parameters.

PoC:
-------------------------------------------
http://www.example.com/igallery41/streamfile.asp?i=./../../../index.asp&f=subdir


Vendor Response:
-------------------------------------------

None as of 06/03/2009

---

Stefano Angaran
http://www.upyou.it
http://blog.upyou.it

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/