lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 17 Jun 2019 17:33:25 -0600
From: aaron bishop <abishop@...ux.com>
To: fulldisclosure@...lists.org
Subject: [FD] BlogEngine.NET Directory traversal + RCE

BlogEngine.NET, versions 3.3.7 and earlier, is vulnerable to two separate
Directory Traversal issues that can lead to Remote Code Execution.

CVE-2019-10719 exploits a directory traversal in /api/upload, allowing
users to write files to any location within the web root.  This bypasses
the protection added in version 3.3.7 to prevent CVE-2019-6714.  A user,
with the ability to add images or files to posts, can upload a malicious
PostView.ascx file to the Themes folder.  The code could then be triggered
by setting the theme parameter to the newly create folder.

CVE-2019-10720 exploits a directory traversal in the theme cookie to
trigger a remote code execution.  A user, with the ability to add images or
files to posts, can upload a malicious PostView.ascx file, then trigger the
RCE by setting the theme cookie to ../../App_Data/files.

Disclosure at:
https://www.securitymetrics.com/blog/BlogEngineNET-Directory-Traversal-Remote-Code-Execution-CVE-2019-10719-CVE-2019-10720

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists