ActiveCollab 2.3.0 - Local File Inclusion / Directory Traversal

============================================================
PAINSEC SECURITY RESEARCH GROUP SECURITY ADVISORY 2010-001
- Original release date: June 24th, 2010
- Discovered by: Jose Carlos de Arriba (dade (at) painsec (dot) com)
- Severity: 10/10 (Base CVSS Score)
============================================================

I. VULNERABILITY
————————-
ActiveCollab 2.3.0 Local File Inclusion / Directory Traversal (prior
version hasn’t been checked so are probably vulnerable).

II. BACKGROUND
————————-
ActiveCollab is a non-free project management & collaboration tool
that you can
set up on your own server or local network. Work with your team,
clients and contractors in an easy to use environment, while keeping
full control over your data.

III. DESCRIPTION
————————-
ActiveCollab presents a Local File Inclusion / Directory Traversal
vulnerability on its “module” parameter, due to an insufficient
sanitization on user supplied data.

A malicious user could get all the files in the web server, and also
get all a shell in the system, in case of being able to write PHP code
in any file that could be loaded through the “module” parameter
(i.e Apache logs).

IV. PROOF OF CONCEPT
————————-
http://www.victim.com/active/index.php?action=DetailView&module=/../../../../../../../etc/passwd%00<http://www.victim.com/active/index.php?action=DetailView&module=/../..>

V. BUSINESS IMPACT
————————-
An attacker could get all files in the server or gain complete access.

VI. SYSTEMS AFFECTED
————————-
ActiveCollab 2.3.0 (prior version hasn’t been checked so are probably
vulnerable).

VII. SOLUTION
————————-
Corrected

VIII. REFERENCES
————————-
http://www.activecollab.com
http://www.painsec.com
http://www.dadesecurity.com

IX. CREDITS
————————-
This vulnerability has been discovered
by Jose Carlos de Arriba (dade (at) painsec (dot) com).

X. REVISION HISTORY
————————-
June 24, 2010: Initial release.

XI. DISCLOSURE TIMELINE
————————-
June 9, 2010: Discovered by Jose Carlos de Arriba (Dade).
June 19, 2010: Vendor contacted including PoC. No response.
June 20, 2010: Response from ActiveCollab developer confirming
future fix.
June 24, 2010: Vulnerability fixed on 2.3.1 version release.

XII. LEGAL NOTICES
————————-
The information contained within this advisory is supplied “as-is”
with no warranties or guarantees of fitness of use or otherwise.