00047-08302004.txt

`##########################################################  
# GulfTech Security Research August, 30th 2004  
##########################################################  
# Vendor : Jerod Moemeka  
# URL : http://www.thinxoft.com  
# Version : Xedus 1.0  
# Risk : Multiple Vulnerabilities  
##########################################################  
  
Description:  
Xedus is a Peer-to-Peer web server and provides you with the   
ability to share files, music, and any other media, as well   
as create robust and dynamic web sites, which can feature   
database access, file system access, with full .net support.   
Powered by a built in server-side, Microsoft C#, scripting   
language; Xedus boasts the ability to create sites that can   
rival web applications built on any other enterprise servers   
like Apache, IIS, Iplanet. With Xedus, you will never need   
to pay to host your sites again. Using the peer-to-peer mode,   
other members of LIVE can access you site by keyword using  
Internet Explorer even if you do not have a static IP address!  
  
  
  
Denial of Service:  
Xedus Webserver cannot handle multiple connections from the   
same host, and will deny all access to any users after a  
number of connections are made from a malicious user. This  
vulnerability can be leveraged by an attacker to deny all  
requests to a website, thus rendering it inaccessible.  
  
  
  
Cross Site Scripting:  
Xedus Webserver comes with a number of test scripts. These  
test scripts are used to display some of the capabilities of  
the Xedus webserver.   
  
http://host:4274/test.x?username=[XSS]  
http://host:4274/TestServer.x?username=[XSS]  
http://host:4274/testgetrequest.x?param=[XSS]  
  
However, the input received by some of these test scripts are   
not properly sanitized. Because the input is not properly  
sanitized, it allows for an attacker to send a malicious url  
that will then render malicious code in the context of a   
victim's web browser. A quick and easy way to resolve these xss  
issues is to delete the .x files located in the ./sampledocs  
folder of the Xedus Webserver installation.  
  
  
  
Directory Traversal Vulnerability:  
Xedus webserver does not properly sanitize requests sent to the  
server. This vulnerability can be exploited to retrieve arbitrary,   
potentially sensitive files from the hosting computer with the   
privileges of the web server. This may aid a malicious user in   
further attacks.  
  
http://host:4274/../data/log.txt  
http://host:4274/../../../../../boot.ini  
http://host:4274/../../../../../WINNT/repair/sam  
  
It should be noted, that by default the Xedus Webserver listens  
for incoming connections on port 4274, however this value can be  
edited by the administrator of the Xedus webserver.  
  
  
  
Solution:  
I contacted the developers but never received a response. To  
resolve the Cross Site Scripting issue, simply remove the sample  
.x scripts located in the ./sampledocs directory  
  
  
  
Related Info:  
The original advisory can be found at the following location   
http://www.gulftech.org/?node=research&article_id=00047-08302004  
  
  
  
Credits:  
James Bercegay of the GulfTech Security Research Team  
  
`