full-disclosure - Aspen 0.8 - Directory Traversal

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAKyu8DXgspMwhFPCjEJTNsP91emLVQ+4hur=bP7Ci0x+g2JZwA@mail.gmail.com>
Date: Mon, 1 Apr 2013 09:08:15 -0300
From: Daniel Ricardo dos Santos <danielrs@...plus.com.br>
To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com, 
 submissions@...ketstormsecurity.com
Subject: Aspen 0.8 - Directory Traversal

Aspen 0.8 - Directory Traversal
Earlier versions are also possibly vulnerable.

INFORMATION

Product: Aspen 0.8
Remote-exploit: yes
Vendor-URL: http://www.zetadev.com/software/aspen/

Discovered by: Daniel Ricardo dos Santos
CVE Request - 15/03/2013
CVE Assign - 18/03/2013
CVE Number - CVE-2013-2619
Vendor notification - 18/03/2013
Vendor reply - No reply
Public disclosure - 01/04/2013

OVERVIEW

Aspen 0.8 is vulnerable to a directory traversal.

INTRODUCTION

Aspen is a Python webserver.
Aspen is framework-agnostic and relies heavily on WSGI.
Aspen is fast enough.

VULNERABILITY DESCRIPTION

The vulnerability happens when directory indexing is turned on (default
configuration in this version) and a user requests, for instance
localhost/../../../../../../../etc/passwd.

The vulnerability may be tested with the following command-line:
curl -v4 http://<server>:<port>/../../../../../../etc/passwd

VERSIONS AFFECTED

Tested with version 0.8 but earlier versions are possibly vulnerable.

SOLUTION

Upgrade to version 0.22 - http://aspen.io/

NOTES

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2013-2619 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
security problems.

CREDITS

Daniel Ricardo dos Santos
SEC+ Information Security Company - http://www.secplus.com.br/

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/