2007-01-24 11:11:37 by: h4x0r
SoftArtisans FileUp viewsrc.asp remote script source disclosure exploit
Advisory Name: SoftArtisans FileUp(TM) viewsrc.asp remote script source disclosure exploit
Tested and Confirmed Vulerable: SoftArtisans SAFileUp(TM) 5.0.14 (Standard)
Severity: High
Type: Script source disclosure
From where: Remote
Discovered by: Inge Henriksen (http://ingehenriksen.blogspot.com/)
Vendor Status: Notified
Overview:
SoftArtisans FileUp(TM) is a popular web server component for transactional uploading of files to a web server using a web browser.
When installing SoftArtisans FileUp(TM) you should avoid installing the samples as viewsrc.asp can let remote anonymous users see script source code or configuration settings outside the /SAFileUpSamples virtual directory. This is accomplished by modifying the "path" query variable to point to files outside the designated directory. A web browser from a remote location is a sufficient tool to see the source code or configuration settings in plain text.
Proof-of Concept:
The following url would show the configuration settings for www.example.xom:
http://www.example.xom/SAFileUpSamples/util/viewsrc.asp?path=/SAFileUpSamples/%c0%ae./%c0%ae./web.config
The %c0%ae is Unicode for the "." character on a english language server, the url is therefore interpreted by the server as http://www.example.xom/SAFileUpSamples/util/viewsrc.asp?path=/SAFileUpSamples/../../web.config, in addition the unicode character avoids the security checks inside the code of viewsrc.asp which won't let any ".." pass through. Keep in mind that other unicode's will also work. Also note that OS'es with other language settings will be vulnerable to different unicodes, thus %c0%ae might not work on a chinese server but some other unicode's should work just as well.
Comments Feed: http://www.4evil.org/feed.asp?q=comment&id=810
Tested and Confirmed Vulerable: SoftArtisans SAFileUp(TM) 5.0.14 (Standard)
Severity: High
Type: Script source disclosure
From where: Remote
Discovered by: Inge Henriksen (http://ingehenriksen.blogspot.com/)
Vendor Status: Notified
Overview:
SoftArtisans FileUp(TM) is a popular web server component for transactional uploading of files to a web server using a web browser.
When installing SoftArtisans FileUp(TM) you should avoid installing the samples as viewsrc.asp can let remote anonymous users see script source code or configuration settings outside the /SAFileUpSamples virtual directory. This is accomplished by modifying the "path" query variable to point to files outside the designated directory. A web browser from a remote location is a sufficient tool to see the source code or configuration settings in plain text.
Proof-of Concept:
The following url would show the configuration settings for www.example.xom:
http://www.example.xom/SAFileUpSamples/util/viewsrc.asp?path=/SAFileUpSamples/%c0%ae./%c0%ae./web.config
The %c0%ae is Unicode for the "." character on a english language server, the url is therefore interpreted by the server as http://www.example.xom/SAFileUpSamples/util/viewsrc.asp?path=/SAFileUpSamples/../../web.config, in addition the unicode character avoids the security checks inside the code of viewsrc.asp which won't let any ".." pass through. Keep in mind that other unicode's will also work. Also note that OS'es with other language settings will be vulnerable to different unicodes, thus %c0%ae might not work on a chinese server but some other unicode's should work just as well.
Comments Feed: http://www.4evil.org/feed.asp?q=comment&id=810
只不过/../../跳出去的时候
"."改为编码了