Upload directory traversal in Easy File Sharing 4.5
#######################################################################
Luigi Auriemma
Application: Easy File Sharing Web Server
http://www.sharing-file.com
Versions: <= 4.5
Platforms: Windows
Bugs: A] upload directory traversal
B] download of database files
C] possibility of reading sensitive files
Exploitation: remote
Date: 07 Dec 2007
Author: Luigi Auriemma
e-mail: aluigi@xxxxxxxxxxxxx
web: aluigi.org
#######################################################################
1) Introduction
2) Bugs
3) The Code
4) Fix
#######################################################################
===============
1) Introduction
===============
Easy File Sharing Web Server is a commercial file sharing software
which allows the downloading and the uploading of files through the web
browser.
#######################################################################
=======
2) Bugs
=======
-----------------------------
A] upload directory traversal
-----------------------------
An attacker can upload a specific file outside the destination folder
with the possibility of overwriting those already existent using the
upload feature available for the user's folder, the forum and the other
possible virtual folders.
The attacker must have the needed privileges for uploading files (by
default guests can upload files on the forum so in this case there are
no problems) and "Allow files to be overwritten" (enabled by default)
must be active for owerwriting the existent files.
-----------------------------
B] download of database files
-----------------------------
All the .sdb database files (MyDB, http://www.mghsoft.com) except
admin.sdb and user.sdb can be downloaded from external users which can
retrieve some sensitive informations from them.
These informations can be very useful in conjunction to the other
vulnerabilities described in this advisory.
-----------------------------------------
C] possibility of reading sensitive files
-----------------------------------------
By default when an user registers an account on the server a new folder
with his name is created in the users folder (by default c:\).
If the user uses the same name of an existent file in that folder
(for example boot.ini) he and any other external client will be able to
read that file if they access to that virtual folder.
Note that doesn't seem possible to use directory traversal tricks and
directories.
Due to the low risk of this bug it's reported here only for
thoroughness.
#######################################################################
===========
3) The Code
===========
A]
http://aluigi.org/poc/efsup.zip
B]
http://SERVER/vfolder.sdb
C]
create a new account using the name of a file existent in the users
folder, for example boot.ini, then (without the need to login) go on
http://SERVER/boot.ini and you will see the content of c:\boot.ini
#######################################################################
======
4) Fix
======
The bugs will be fixed in a future version.
#######################################################################
---
Luigi Auriemma
http://aluigi.org