EasyWeb FileManager Discloses Files to Remote User
|
|
SecurityTracker Alert ID: 1010768
|
|
SecurityTracker URL: http://securitytracker.com/id?1010768
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jul 24 2004
|
Impact: Disclosure of system information, Disclosure of user information
|
Exploit Included: Yes
|
Version(s): 1.0 RC-1
|
Description: A directory traversal vulnerability was reported in EasyWeb FileManager for PostNuke. A remote user can view files on the target system.
sullo reported that a remote user can supply a specially crafted value for the 'pathext' and 'view' variables to view arbitrary files
on the target system with the privileges of the target web service. Directory listings can be obtained by submitting a relative
path in the 'pathext' variable and files can be obtained by sumitting the filename in the 'view' variable.
Some demonstration
exploit URLs are provided:
/index.php?module=ew_filemanager&type=admin&func=manager&pathext=../../../etc
/index.php?module=ew_filemanager&type=admin&func=manager&pa
thext=../../../etc/&view=passwd
The vendor was reportedly notified without response.
The original advisory is available at:
http://www.cirt.net/advisories/ew_fil
e_manager.shtml
|
Impact: A remote user can view files on the target system with the privileges of the target web service.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: home.postnuke.ru/index.php?module=subjects&func=listcat&catid=2 (Links to External Site)
|
Cause: Access control error, Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: sullo@cirt.net
|
Message History:
None.
|
Source Message Contents
|
Date: Fri, 23 Jul 2004 20:40:56 -0400
From: sullo@cirt.net
Subject: [VulnWatch] EasyWeb FileManager Directory Traversal
|
Product:
EasyWeb FileManager Module - http://home.postnuke.ru/index.php
Description:
EasyWeb FileManager Module for PostNuke is vulnerable to a directory traversal
problem which allows retrieval of arbitrary files from the remote system.
Systems Affected:
EasyWeb FileManager 1.0 RC-1
Technical Description:
The PostNuke module works by loading a directory and/or file via the "pathext"
(directory) and "view" (file) variables. Providing a relative path (from the
document repository) in the "pathext" variable will cause FileManager to
provide a directory listing of that diretory. Selecting a file in that listing,
or putting a file name in the "view" variable, will cause EasyWeb to load the
file specified. Only files and directories which can be read by the system user
running PHP can be retrieved.
Assuming PostNuke is installed at the root level:
/etc directory listing:
/index.php?module=ew_filemanager&type=admin&func=manager&pathext=../../../etc
/etc/passwd file:
/index.php?module=ew_filemanager&type=admin&func=manager&pathext=../../../etc/&view=p
asswd
Fix/Workaround:
Use another file manager module for PostNuke, as the authors do not appear to be
maintaining EW FileManager.
Vendor Status:
Vendor was contacted but did not respond.
References:
OSVDB-8193 http://www.osvdb.org/8193
Original Advisory http://www.cirt.net/advisories/ew_file_manager.shtml
--
http://www.cirt.net/ | http://www.osvdb.org/
|
|
