Apache Cocoon 'view-source' Sample Script Discloses Files to Remote Users
|
|
SecurityTracker Alert ID: 1007993
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Oct 24 2003
|
Impact: Disclosure of system information, Disclosure of user information
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): 2.1, 2.2
|
Description: A vulnerability was reported in one of the sample files distributed with Apache Cocoon. A remote user can view arbitrary files on the system that are readable by the web server process.
It is reported that the 'view-source' sample script allows a remote user to submit a specially crafted request containing '../' directory
traversal characters to view arbitrary files on the system.
A demonstration exploit URL is provided:
http://[target]:8888/samples/view-source?filename=../../../boot
.ini
The vendor was notified on October 20, 2003.
Thierry De Leeuw reported the bug at:
http://nagoya.apache.org/bugzilla/show_bug.cgi?id=23949
|
Impact: A remote user can view arbitrary files on the system with the privileges of the web server process.
|
Solution: A fix for version 2.1 and 2.2 is available via CVS (as of October 22, 2003):
http://cocoon.apache.org/mirror.cgi
|
Vendor URL: cocoon.apache.org/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Underlying OS Comments: Confirmed on Windows
|
|
Message History:
None.
|
Source Message Contents
|
Date: Thu, 23 Oct 2003 23:53:49 -0400
Subject: http://nagoya.apache.org/bugzilla/show_bug.cgi?id=23949
|
A directory traversal vulnerability was reported by Thierry De Leeuw in Apache Cocoon
versions 2.2 and prior.
http://nagoya.apache.org/bugzilla/show_bug.cgi?id=23949
> http://a_Host.com:8888/samples/view-source?filename=../../../boot.ini allows
> to download the "boot.ini" file (located in the root of C drive under Window
> NT/2000/XP).
>
> I know this is only a sample script but unfortunately a lot of people do
> install their production machines with samples installed...
>
> A check on the filename should be done.
|
|
