[13015] in bugtraq
Groupewise Web Interface
daemon@ATHENA.MIT.EDU (Sacha Faust Bourque)
Mon Dec 20 11:31:39 1999
Message-Id: <A39CA57849A9D1118A9C0060081695B00613D509@MULTI005>
Date: Sun, 19 Dec 1999 18:08:00 -0500
Reply-To: Sacha Faust Bourque <sfaust@HARTCO.COM>
From: Sacha Faust Bourque <sfaust@HARTCO.COM>
X-To: bugtraq@securityfocus.com
To: BUGTRAQ@SECURITYFOCUS.COM
Problems found with GroupeWise web server ( Novell was contacted 3 weeks ago
and no reply )
-----------------------------------------------------------------
1. The help argument in GWWEB.EXE reveal full web path on the server
2. anyone can read a .htm file on the system with the GWWEB.EXE and the HELP
argument.
Example:
1. ( full web server path )
By sending http://server/cgi-bin/GW5/GWWEB.EXE?HELP=bad-request
the server will reply
Could not find file SYS:WEB\CGI-BIN\GW5\US\HTML3\HELP\BAD-REQUEST.HTM
2. ( read any .htm file )
by sending http://server/cgi-bin/GW5/GWWEB.EXE?HELP=../../../../../index (
refering to the path returned in the previous example ). You will see the
main web site interface.
We did some intensive test with the HELP trying to get rid of the .htm that
it happens and we were unable to
get rid of it. We are currently testing other arguments sent to GWWEB.EXE.
This was tested on GroupWise 5.2 and 5.5 .
This was found by Laurent Hollo and me.
Sacha Faust Bourque
sfaust@hartco.com
