full-disclosure - nginx - low risk webdav destination bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 23 Sep 2009 11:12:13 +0200
From: Kingcope <kcope2@...glemail.com>
To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com, 
	submit@...w0rm.com
Subject: nginx - low risk webdav destination bug

Bug Title: nginx webdav copy/move method directory traversal
Program: nginx
Version: nginx/0.7.61 - other versions may also be affected
Website: http://sysoev.ru/nginx/
Severity: Low
Date discovered: 23 September 2009

The webdav component has to be enabled and the user has to have
permission to use the COPY or MOVE methods.

Description:
nginx ("Engine X", written by Igor Sysoev) has the ability to be used
as a webdav publishing server.
With webdav you can for example copy or move files from
one to a different location. The move and copy methods require a
"Destination:" HTTP header.
The destination header contains information about where the file
should be placed.
By using characters like "../" the attacker can traverse down the
directory tree and place files
outside the webroot. This is an insecure behaviour of the nginx webdav
module and can be
especially dangerous when nginx is used in a virtual hosting
environment. nginx runs as the
user nobody per default so normally this bug is not a big deal since
an attacker may only
be allowed to write files to /tmp/ or nobody owned directories. The
severity is low because
this attack requires webdav "upload" permissions.

Here is a sample request for the bug:

COPY /index.html HTTP/1.1
Host: localhost
Destination: http://localhost/../../../../../../../tmp/nginx.html

Thanks for your time,

Kingcope - kcope2@...glemail.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/