full-disclosure - [FD] EasyCafe Server <= 2.2.14 Remote File Read

Open Source and information security mailing list archives

Date: Thu, 24 Dec 2015 16:59:17 -0800
From: Rio Sherri <rio.sherri@...nstudent.info>
To: fulldisclosure <fulldisclosure@...lists.org>
Subject: [FD] EasyCafe Server <= 2.2.14 Remote File Read

# Title : EasyCafe Server <= 2.2.14 Remote File Read
# Date : 25/12/2015
# Author : R-73eN
# Tested on : Windows 7 Ultimate
# Software Link : http://www.tinasoft.com/easycafe/
# Vulnerable Versions : EasyCafe Server <= 2.2.14
# EasyCafe Server has a feature to upload file from the server to a client.
# And the request is as following. EasyCafe Server sends an UDP request to
the client with the file that wants to upload,
# Then the client receives the packet and connects to the server on port
831 and sends the directory of the file and receives it.
# The problem is that a remote attacker can connect to port 831 and can
retrive a file because the server doesn't validate the request,
# and does not check if it has sent the UDP request which gives us full
Read access to the system.

POC is attached.

View attachment "tinasoft.py" of type "text/plain" (1943 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives