QuiXplorer directory traversal
Title: QuiXplorer directory traversal
Affects:
<= QuiXplorer 2.3
Effect: file disclosure, web server's user read access
Id: cbsa-0003
Release Date: 2004 08 14
Author: Cyrille Barthelemy <cb-publicbox@xxxxxxxxxxx>
-- 1. Introduction
------------------
From QuiXplorer documentation :
"QuiXplorer is a simple, but fully functional, file manager for websites.
QuiXplorer allows you to browse the files & directories on your webserver
(with PHP4). (without using an external FTP-client)"
-- 2. Problem
-------------
QuiXplorer does not apply filters on user inputs when a download is
requested.
The directory parameter is well filtered to check that it does not
create a request
that goes outside the authorized directories, but the item can contains
parent directory
references.
As quixplorer does not make the request ing the web server features, any
file on the
server can be obtained (according to jail or chroot).
-- 3. Solution
--------------
Apply the given attached patch against the QuiXplorer 2.3 sources or
download the
latest version (2.3.1) from the web site.
-- 4. References
----------------
- QuiXplorer web site
http://quixplorer.sourceforge.net/
-- 5. History
-------------
2004-08-12
- Vulnerability discovered
2004-08-12
- Vulnerability reported to quixproject at users.sourceforge.net
- Vendor response, new version available
2004-08-14
- Release
-- 6. Patch
-----------
------------8<-------------
--- quixplorer_2_3.orig/.include/fun_down.php 2003-04-25
22:15:28.000000000 +0200
+++ quixplorer_2_3/.include/fun_down.php 2004-08-12 14:23:46.551569904
+0200
@@ -39,6 +39,7 @@
------------------------------------------------------------------------------*/
//------------------------------------------------------------------------------
function download_item($dir, $item) { // download file
+ $item=basename($item);
if(($GLOBALS["permissions"]&01)!=01)
show_error($GLOBALS["error_msg"]["accessfunc"]);
if(!get_is_file($dir,$item)) show_error($item.":
".$GLOBALS["error_msg"]["fileexist"]);
if(!get_show_item($dir, $item)) show_error($item.":
".$GLOBALS["error_msg"]["accessfile"]);
------------8<-------------
--
Cyrille Barthelemy
Epita SRS
http://www.cyrille-barthelemy.com
http://www.vnet-project.org