[17092] in bugtraq
Security Advisory: Hassan Consulting's shop.cgi Directory
daemon@ATHENA.MIT.EDU (f0bic)
Sun Oct 8 15:18:13 2000
Content-Type: text/plain
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
Message-Id: <00100702460801.04993@ninja>
Date: Sat, 7 Oct 2000 02:45:08 -0400
Reply-To: f0bic@deadprotocol.org
From: f0bic <f0bic@DEADPROTOCOL.ORG>
To: BUGTRAQ@SECURITYFOCUS.COM
[ October 7, 2000 ]
Security Advisory (shop.cgi.ad-1.00-10) : Hassan Consulting's Shopping Cart (shop.cgi) Directory Traversal Vulnerability
Affected Product:
* Hassan Consulting's Shopping Cart (shop.cgi/shop.pl) Version 1.18 (possibly others aswell)
Affected Platforms:
* Unix
* Windows
Overview:
Hassan Consulting's Shopping Cart is one of the thousands of shopping scripts out there. It supports SSL, contains authentication
modules for Cybercash, Authorize.net, and Linkpoint. The shop.cgi uses secure authentication through modules with's it's configuration
file in shop.cfg.
Description:
The regular syntax for displaying shopping information is: http://example.com/cgi-bin/shop.cgi/page=products.htm/SID=SHOPPING_ID_HERE .
This will display a page called products.htm with the shopper's id (shoppers cart, information, etc.). The $page variable is displayed by
calling an open() statement. This open statement doesn't perform any input/access validation and has no bounderied directories, therefore
allowing http://example.com/cgi-bin/shop.cgi/page=../../../../etc/passwd to be passed in the open statement and /etc/passwd to be opened.
The affected files are shop.cgi and shop.pl located in the cgi scripts directories (/cgi-bin, /cgi-local, /scripts, and the like).
Solution:
By adding input validation using regex, you can single out characters such as ../ , .\./ . Also maybe a variable should be added that
limits the dept of the directory traversal. These two combined can prevent arbitrary directory traversal from being performed by a
possible attacker.
---------------------------------
by f0bic (f0bic@deadprotocol.org)
zSh - http://zsh.interniq.org
