[25382] in bugtraq
Lysias Lidik Webserver suffers from a Directory Traversal Vulnerability
daemon@ATHENA.MIT.EDU (Florian Hobelsberger / BlueScreen)
Tue May 7 23:41:23 2002
Message-ID: <001e01c1f62f$93f1aeb0$0100a8c0@BlueScreenPrimary>
From: "Florian Hobelsberger / BlueScreen" <genius28@gmx.de>
To: <bugtraq@securityfocus.com>
Date: Wed, 8 May 2002 03:27:19 +0200
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
- ------------------------------------------------------------
itcp advisory 14 advisories@it-checkpoint.net
http://www.it-checkpoint.net/advisory/14.html
May 8th, 2002
- ------------------------------------------------------------
Lysias Lidik Webserver suffers from a Directory Traversal Vulnerability
- -------------------------
Affected programs: Lysias Lidik Webserver 0.7b
URL: www.lysias.de
Vendor: L.Y.S.I.A.S.
Vulnerability-Class: Directory Traversal
OS specific: Windows
Problem-Type: remote
SUMMARY
Lysias Lidik Webserver is quite a small Webserver (Installation file is
about 700 KB) and
offers various features including SSL-Support.
Further, it seems to be an attempt to create a secure webserver since "not
allowed requests"
are shown seperated from the usual requests.
( I love programmers who also think about the safety of their programs).
DETAILS
When trying to request http://localhost/../, it didn't work but the number
of "not allowed requests"
increased by 1.
Then, trying it with http://localhost////./../.../ , it suddenly worked and
i got
the contents of E:, on which the Server root lies in \security.
IMPACT
The Server root can be exited and almost any file on the same disk could be
downloaded
(including password files or other sensitive information).
It seems like it is not possible to enter directories in this way which have
a space in
their name (%20 at the browser).
EXPLOIT
If the webserver is running at localhost, just enter
http://localhost/.../
in the address windows at the browser.
SOLUTION
Since there already seems to exist a protection against regular Directory
Traversal attempts
(/../), this should be widened to prevent Directory Traversal attempts with
three (or multiple) dots.
Entering more than three dots doesn't work for me.
ADDITIONAL INFORMATION
Vendor has been contacted.
Bug discovered and published by Florian "BlueScreen" Hobelsberger
( BlueScreen@IT-Checkpoint.net ) from
www.IT-Checkpoint.net
-----------------------
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
