Collaborative Passwords Manager (cPassMan) 1.82 Arbitrary File Download

`Sense of Security - Security Advisory - SOS-11-004  
  
Release Date. 15-Apr-2011  
Last Update. -  
Vendor Notification Date. 7-Mar-2011  
Product. Collaborative Passwords Manager (cPassMan)  
Platform. Independent (PHP)  
Affected versions. 1.82 (verified), and possibly others  
Severity Rating. Medium  
Impact. Local file system access  
Attack Vector. Remote without authentication  
Solution Status. Upgrade to v2.0, v1.x branch no longer   
updated  
CVE reference. Not yet assigned  
  
Details.  
A vulnerability has been discovered in the Collaborative Passwords Manager  
(cPassMan) web application that can be exploited to retrieve files from the  
local host file system. The input passed to the component  
"sources/downloadfile.php" via the "path" variable allows the retrieval of   
any  
file on the local file system that the web server has access to. There is no  
data validation or authorisation mechanisms present within this component.  
  
Proof of Concept.  
http://localhost/cpassman/sources/downloadfile.php?path=/etc/passwd  
  
Solution.  
The author (Nils Laumaille) has indicated that the v1.x branch of cPassMan  
will no longer be updated, as he has rewritten the application and v2.0 is   
now  
the recommended release.  
  
Discovered by.  
Kaan Kivilcim - Sense of Security Labs.  
  
About us.  
Sense of Security is a leading provider of information  
security and risk management solutions. Our team has expert  
skills in assessment and assurance, strategy and architecture,  
and deployment through to ongoing management. We are  
Australia's premier application penetration testing firm and  
trusted IT security advisor to many of the country's largest  
organisations.  
  
Sense of Security Pty Ltd  
Level 8, 66 King St  
Sydney NSW 2000  
AUSTRALIA  
T: +61 (0)2 9290 4444  
F: +61 (0)2 9290 4455  
W: http://www.senseofsecurity.com.au  
E: [email protected]  
Twitter: @ITsecurityAU  
  
The latest version of this advisory can be found at:  
http://www.senseofsecurity.com.au/advisories/SOS-11-004.pdf  
  
Other Sense of Security advisories can be found at:  
http://www.senseofsecurity.com.au/research/it-security-advisories.php   
`