DevExpress ASP.NET File Manager 13.2.8 Directory Traversal

`Advisory: Directory Traversal in DevExpress ASP.NET File Manager  
  
During a penetration test RedTeam Pentesting discovered a directory  
traversal vulnerability in DevExpress' ASP.NET File Manager and File  
Upload. Attackers are able to read arbitrary files by specifying a  
relative path.  
  
Details  
=======  
  
Product: DevExpress ASPxFileManager Control for WebForms and MVC  
Affected Versions: DevExpress ASPxFileManager v10.2 to v13.2.8  
Fixed Versions: DevExpress ASPxFileManager v13.2.9  
Vulnerability Type: Directory Traversal  
Security Risk: high  
Vendor URL:  
https://www.devexpress.com/Products/NET/Controls/ASP/File-Upload-Explorer/  
Vendor Status: fixed version released  
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2014-006  
Advisory Status: published  
CVE: CVE-2014-2575  
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2575  
  
  
Introduction  
============  
  
"The DevExpress ASP.NET Subscription includes a standalone Multi-File  
Upload Manager for WebForms and MVC and a pre-built File Manager for  
WebForms; built so you can instantly introduce file management  
capabilities in your next web application."  
  
(from DevExpress' Homepage)  
  
  
More Details  
============  
  
The ASPX File Manager component is prone to a directory traversal  
vulnerability. Attackers with access to the File Manager component can  
read arbitrary files on the same partition as the shared directory.  
  
A common request to download a file via the File Manager component  
requires multiple HTTP-Post parameters:  
  
__EVENTTARGET=ctl00%24ContentPlaceHolder1%24ASPxFileManager1  
__EVENTARGUMENT=13%7C<file.ext>  
__EVENTVALID=  
  
The parameter __EVENTARGUMENT=13|<file.ext> specifies a file download  
and the file which is to be downloaded. Attackers may also request files  
outside of the shared directory by prepending a relative path to a  
parent directory.  
  
  
Proof of Concept  
================  
  
By requesting files with a relative path, files otherwise not available  
will be accessible through the File Manager component. Depending on the  
shared directory and the webserver configuration, the webserver  
configuration file might for example be accessible through the File  
Manager component:  
  
__EVENTARGUMENT=13|../../web.config  
  
Other sensitive operating system files could be affected, too.  
  
Example exploit:  
------------------------------------------------------------------------  
curl --data __EVENTTARGET=ctl00%24ContentPlaceHolder1%24ASPxFileManager1\  
"&__EVENTARGUMENT=13%7C../../web.config&=&__EVENTVALID" \  
http://example.com/FileManagerComponent.aspx  
------------------------------------------------------------------------  
  
The request above will download the specified file.  
  
  
Workaround  
==========  
  
Instead of a physical file system provider, a database file system  
provider with limited access permissions could be used.  
  
  
Fix  
===  
  
Update ASPxFileManager control to DevExpress libraries version v13.2.9.  
  
  
Security Risk  
=============  
  
The risk is estimated to be high. This vulnerability allows attackers to  
access arbitrary files on the same partition as the File Manager's root  
directory. This may allow attackers to read sensitive information like  
the webserver configuration.  
  
  
Timeline  
========  
  
2014-03-10 Vulnerability identified  
2014-03-21 Customer approved disclosure to vendor  
2014-03-21 CVE number requested and assigned  
2014-03-25 Vendor notified  
2014-04-11 Customer opened support ticket with vendor  
2014-04-17 Vendor released fixed version  
2014-04-17 Vendor released security advisory to customers  
2014-06-05 Advisory released  
  
  
References  
==========  
  
Vendor Security Advisory:  
http://security.devexpress.com/de7c4756/?id=ff8c1703126f4717993ac3608a65a2e2  
  
  
RedTeam Pentesting GmbH  
=======================  
  
RedTeam Pentesting offers individual penetration tests, short pentests,  
performed by a team of specialised IT-security experts. Hereby, security  
weaknesses in company networks or products are uncovered and can be  
fixed immediately.  
  
As there are only few experts in this field, RedTeam Pentesting wants to  
share its knowledge and enhance the public knowledge with research in  
security related areas. The results are made available as public  
security advisories.  
  
More information about RedTeam Pentesting can be found at  
https://www.redteam-pentesting.de.  
  
--   
RedTeam Pentesting GmbH Tel.: +49 241 510081-0  
Dennewartstr. 25-27 Fax : +49 241 510081-99  
52068 Aachen https://www.redteam-pentesting.de  
Germany Registergericht: Aachen HRB 14004  
Geschäftsführer: Patrick Hof, Jens Liebchen  
`