Sambar Server 'showini.asp' and 'showlog.asp' Disclose Files to Remote Authenticated Administrators
|
|
SecurityTracker Alert ID: 1010353
|
|
SecurityTracker URL: http://securitytracker.com/id?1010353
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jun 1 2004
|
Impact: Disclosure of authentication information, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): 6.1 Beta 2
|
Description: Some vulnerabilities were reported in Sambar Server. A remote authenticated administrator can view files located outside on the Sambar Server directory. A remote user can also conduct cross-site scripting attacks.
Oliver Karow reported that an administrator can invoke 'showini.asp' or 'showlog.asp' with a specially crafted URL to view files
on the system.
Some demonstration exploit URLs are provided:
http://myserver/sysadmin/system/showini.asp?file=\..\..\..\..\..\..\..\boot.ini
http://localhost/sys
admin/system/showlog.asp?log=c:\boot.ini&tail=y
The report notes that administration of the Sambar proxy is restricted to the
localhost by default.
It is also reported that the 'show.asp' and 'showperf.asp' scripts do not filter HTML code from user-supplied
input before displaying the information. A remote user can create a specially crafted URL that, when loaded by a target user, will
cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the Sambar
Server software and will run in the security context of that site. As a result, the code will be able to access the target user's
cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user
via web form to the site, or take actions on the site acting as the target user.
Some demonstration exploit URLs are provided:
http://localhost/sysadmin/system/sho
w.asp?show=<script>alert("oops")</script>
http://localhost/sysadmin/system/showperf.asp?area=search&title=<script>alert(document.cookie)</script>
The
vendor has reportedly been notified.
|
Impact: A remote authenticated administrator can view files on the system.
A remote user can access the target user's cookies (including
authentication cookies), if any, associated with the site running the Sambar Server software, access data recently submitted by
the target user via web form to the site, or take actions on the site acting as the target user.
|
Solution: No solution was available at the time of this entry. The vendor is reportedly working on a fix for the next release.
|
Vendor URL: www.sambar.com/ (Links to External Site)
|
Cause: Access control error, Input validation error
|
Underlying OS: Windows (Any)
|
Reported By: <oliver@greyhat.de>
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 1 Jun 2004 11:52:04 +0200
From: <oliver@greyhat.de>
Subject: [Full-Disclosure] =?iso-8859-1?Q?Sambar_Proxy_Multible_Vulnerabilities?=
|
Sambar Proxy Multible Vulnerabilities
=====================================
I found some vulnerabilitites in Sambar Webproxy (www.sambar.com), which
allow the sambar admin access to files outside of the application
directories.
Since Sambar comes with no password for admin as default, it might be a
security problem, if administration of Sambar proxy is allowed from any
IP (by default it is restricted to 127.0.0.1!).
In Addition, i found some XSS.
Directory Traversal
===================
http://myserver/sysadmin/system/showini.asp?file=\..\..\..\..\..\..\..\boot.ini
See: www.oliverkarow.de/research/sambar_trav.GIF
Direct File Access
==================
http://localhost/sysadmin/system/showlog.asp?log=c:\boot.ini&tail=y
Cross Site Scripting
====================
http://localhost/sysadmin/system/show.asp?show=<script>alert("oops")</script>
http://localhost/sysadmin/system/showperf.asp?area=search&title=<script>alert(document.cook
ie)</script>
Version
=======
I only tested Sambar 6.1 Beta 2 on Windows platform (x86). Other
versions/platforms may also be affected.
Vendor
======
www.sambar.com
Vendor is informed, and is fixing this vulns in the next release.
Workaround
==========
Set a password for admin account and restrict administration to
localhost (default).
Credits
=======
15.05.2004 www.oliverkarow.de
www.oliverkarow.de/research/sambar.txt
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
|
|
