CakePHP 2.3.7 / 2.2.8 Local File Inclusion

`CVE Number: N/A (not assigned)  
Title: CakePHP AssetDispatcher Local File Inclusion Vulnerability  
Affected Software: Confirmed on CakePHP v2.3.7, v2.2.8  
(prior versions may also be affected)  
Credit: Takeshi Terada of Mitsui Bussan Secure Directions, Inc.  
Issue Status: v2.3.8 & 2.2.9 was released which fixes this vulnerability  
  
Overview:  
CakePHP is an open-source web application framework for PHP.  
CakePHP (v2.3.7, 2.2.8 and possibly prior versions) is vulnerable to  
LFI (Local File Inclusion) attack. Remote attacker can abuse this  
vulnerability to steal files on the server or execute PHP commands,  
if the target application has one or more themes or plugins. It is  
caused by insufficient input validation in AssetDispatcher class.  
  
Details:  
CakePHP's AssetDispatcher class serves asset resources (such as image  
files) stored under individual theme or plugin directory. This class  
determines requested resource's path based on PATH_INFO of request URI.  
  
To prevent attacks, this class validates PATH_INFO and stops loading  
requested resource if PATH_INFO contains ".." sequence. But after the  
validation step, PATH_INFO will be urldecoded in _getAssetFile(). This  
allows attackers to bypass ".." check by urlencoded dot chars (%2e).  
  
I present two examples of attack URI. In both examples, Cake serves the  
content of /etc/passwd in HTTP response body.  
  
UR1: http://victim-host/cakephp-2.3.7/theme/Test1/%2e.//%2e.//%2e.//%2e.  
//%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e./etc/passwd  
  
Successful attack requires one or more themes on the target server.  
In the example above, the target application must have "Test1" theme.  
This restriction is due to file_exists() check in beforeDispatch().  
  
URL2: http://victim-host/cakephp-2.3.7/DebugKit/%2e.//%2e.//%2e.//%2e.//  
%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e./etc/passwd  
  
Second example is almost same as first one. The difference is that  
second one requires one or more Cake plugins with webroot directory.  
The plugins must be actually enabled on the target server.  
  
The requested resource is served via include statement, so that PHP  
code execution by LFI is possible if the target Cake application  
allows uploading files such as image, text and so on.  
  
Timeline:  
2013/07/16 Reported to CakePHP Security ML  
2013/07/18 Vender announced v2.3.8 & 2.2.9  
2013/08/13 Disclosure of this advisory  
  
Recommendation:  
Upgrade to the latest version.  
  
Reference:  
http://bakery.cakephp.org/articles/markstory/2013/07/18/cakephp_2_3_8_2_2_9_released  
`