SoftArtisans SAFileUp 5.0.14 - 'viewsrc.asp' Script Source Disclosure

SoftArtisans FileUp viewsrc.asp remote script source disclosure exploit 

Advisory Name: SoftArtisans FileUp(TM) viewsrc.asp remote script source disclosure exploit 
Tested and Confirmed Vulerable: SoftArtisans SAFileUp(TM) 5.0.14 (Standard) 
Severity: High Type: Script 
source disclosure From where: Remote 
Discovered by: Inge Henriksen (http://ingehenriksen.blogspot.com/) 
Vendor Status: Notified Overview: 

SoftArtisans FileUp(TM) is a popular web server component for transactional uploading of files to a 
web server using a web browser. 

When installing SoftArtisans FileUp(TM) you should avoid installing the samples as viewsrc.asp can 
let remote anonymous users see script source code or configuration settings outside the 
/SAFileUpSamples virtual directory. This is accomplished by modifying the "path" query variable to 
point to files outside the designated directory. A web browser from a remote location is a 
sufficient tool to see the source code or configuration settings in plain text. 

Proof-of Concept: 

The following url would show the configuration settings for www.example.xom: 

http://www.example.xom/SAFileUpSamples/util/viewsrc.asp?path=/SAFileUpSamples/%c0%ae./%c0%ae./web.config 


The %c0%ae is Unicode for the "." character on a english language server, the url is therefore 
interpreted by the server as 
http://www.example.xom/SAFileUpSamples/util/viewsrc.asp?path=/SAFileUpSamples/../../web.config, in 
addition the unicode character avoids the security checks inside the code of viewsrc.asp which won't 
let any ".." pass through. Keep in mind that other unicode's will also work. Also note that OS'es 
with other language settings will be vulnerable to different unicodes, thus %c0%ae might not work on 
a chinese server but some other unicode's should work just as well. 

# milw0rm.com [2006-12-30]