Search...

STG Security Advisory 2005-01-20.24

2005-01-25T00:00:00

ID PACKETSTORM:35838
Type packetstorm
Reporter STG Security
Modified 2005-01-25T00:00:00

Description

                                        
                                            `  
  
STG Security Advisory: [SSA-20050120-24] GForge 3.x directory traversal  
vulnerability.  
  
Revision 1.0  
Date Published: 2005-01-20 (KST)  
Last Update: 2005-01-20 (KST)  
Disclosed by SSR Team (advisory@stgsecurity.com)  
  
Summary  
========  
GForge is a software to help collaborative development for software  
communities. The software provides a full configured development system with  
tools for communication and version control among members of a development  
team on a web site. GForge CVS modules have a directory traversal  
vulnerability exploited by malicious attackers.  
  
Vulnerability Class  
===================  
Implementation Error: Input validation flaw  
  
Impact  
======  
Low : arbitrary directory list disclosure.  
  
Affected Products  
================  
GForge 3.3 and prior  
  
Not Affected Products  
=====================  
GForge 4.0 and posterior  
  
Vendor Status: FIXED (GForge 4.0)  
====================  
2004-12-28 Vulnerability found  
2004-12-28 Developers (Dragos Moinescu, Ronald Petty) contacted and  
confirmed.  
2004-12-28 Dragos Moinescu suggested the workaround of his module.  
2004-12-29 Vendor contacted.  
2005-01-20 Official release.  
  
Details  
=======  
GForge CVS module made by Dragos Moinescu and another module made by Ronald  
Petty have a directory traversal vulnerability.  
  
$GFORGE/www/scm/controller.php doesn't sanitize $dir variable.  
- ---  
if(!$dir) {  
$dir = $cvsroot;  
$files = retrieveDir($dir);  
...snip...  
} else {  
$files = retrieveDir($dir);  
- ---  
  
$GFORGE/www/scm/controlleroo.php doesn't sanitize $dir_name variable.  
- ---  
$DIRNAME = ($dir_name != "")?"/$dir_name":"";  
$DIRNAME = $CVSROOT.$DIRNAME;  
$DIRPATH = explode("/",$dir_name);  
echo("Current directory: ");  
for($i=0;$i&lt;count($DIRPATH);$i++)  
{  
...snip...  
if(false === ($dirContent = $DHD-&gt;readDirectory($DIRNAME)))  
echo("Error: ".$DHD-&gt;getError());  
...snip...  
foreach($dirContent AS $k=&gt;$v)  
{  
...snip...  
$fileLink = ...snip...  
- ---  
  
If register_globals = On (in php.ini), malicious attackers can read  
arbitrary directory lists.  
  
Proof of Concept  
================  
1) http://[victim]/scm/controller.php?group_id=[number]  
&dir=/cvsroot/[project]/CVSROOT/../../../../../  
  
2) http://[victim]/scm/controlleroo.php?group_id=[number]  
&dir_name=../../../&hide_attic=0  
  
Solution  
========  
Upgrade to GForge 4.x  
  
Workaround  
==========  
Dragos Moinescu suggested the workaround of his module.  
- ---  
modify $GFORGE/common/include/cvsweb/DirectoryHandler.class  
function openDirectory()  
{  
if($this-&gt;__DIR_NAME == "" || strstr($this-&gt;__DIR_NAME, ".."))  
{  
$this-&gt;setError("You must provide a valid directory name");  
return false;  
}  
- ---  
  
But, above workaround doesn't remove the vulnerability in controller.php (by  
Ronald Petty).  
  
You can restrict users to use only cvsweb.  
modify $GFORGE/www/scm/index.php (follow this step).  
1) find '&lt;a href="/scm/controller.php' and delete the found line.  
2) find '&lt;a href="/scm/controlleroo.php' and delete the found line.  
3) delete controller.php, controlleroo.php, viewFile.php.  
  
Vendor URL  
==========  
http://www.gforge.org/  
  
Credits  
======  
Jeremy Bae at STG Security  
`

JSON Vulners Source

Initial Source

{"id": "PACKETSTORM:35838", "type": "packetstorm", "bulletinFamily": "exploit", "title": "STG Security Advisory 2005-01-20.24", "description": "", "published": "2005-01-25T00:00:00", "modified": "2005-01-25T00:00:00", "cvss": {"vector": "NONE", "score": 0.0}, "href": "https://packetstormsecurity.com/files/35838/STG-Security-Advisory-2005-01-20.24.html", "reporter": "STG Security", "references": [], "cvelist": [], "lastseen": "2016-11-03T10:22:14", "viewCount": 17, "enchantments": {"score": {"value": 0.5, "vector": "NONE"}, "dependencies": {}, "backreferences": {}, "exploitation": null, "vulnersScore": 0.5}, "sourceHref": "https://packetstormsecurity.com/files/download/35838/SSA-20050120-24.txt", "sourceData": "` \n \nSTG Security Advisory: [SSA-20050120-24] GForge 3.x directory traversal \nvulnerability. \n \nRevision 1.0 \nDate Published: 2005-01-20 (KST) \nLast Update: 2005-01-20 (KST) \nDisclosed by SSR Team (advisory@stgsecurity.com) \n \nSummary \n======== \nGForge is a software to help collaborative development for software \ncommunities. The software provides a full configured development system with \ntools for communication and version control among members of a development \nteam on a web site. GForge CVS modules have a directory traversal \nvulnerability exploited by malicious attackers. \n \nVulnerability Class \n=================== \nImplementation Error: Input validation flaw \n \nImpact \n====== \nLow : arbitrary directory list disclosure. \n \nAffected Products \n================ \nGForge 3.3 and prior \n \nNot Affected Products \n===================== \nGForge 4.0 and posterior \n \nVendor Status: FIXED (GForge 4.0) \n==================== \n2004-12-28 Vulnerability found \n2004-12-28 Developers (Dragos Moinescu, Ronald Petty) contacted and \nconfirmed. \n2004-12-28 Dragos Moinescu suggested the workaround of his module. \n2004-12-29 Vendor contacted. \n2005-01-20 Official release. \n \nDetails \n======= \nGForge CVS module made by Dragos Moinescu and another module made by Ronald \nPetty have a directory traversal vulnerability. \n \n$GFORGE/www/scm/controller.php doesn't sanitize $dir variable. \n- --- \nif(!$dir) { \n$dir = $cvsroot; \n$files = retrieveDir($dir); \n...snip... \n} else { \n$files = retrieveDir($dir); \n- --- \n \n$GFORGE/www/scm/controlleroo.php doesn't sanitize $dir_name variable. \n- --- \n$DIRNAME = ($dir_name != \"\")?\"/$dir_name\":\"\"; \n$DIRNAME = $CVSROOT.$DIRNAME; \n$DIRPATH = explode(\"/\",$dir_name); \necho(\"Current directory: \"); \nfor($i=0;$i<count($DIRPATH);$i++) \n{ \n...snip... \nif(false === ($dirContent = $DHD->readDirectory($DIRNAME))) \necho(\"Error: \".$DHD->getError()); \n...snip... \nforeach($dirContent AS $k=>$v) \n{ \n...snip... \n$fileLink = ...snip... \n- --- \n \nIf register_globals = On (in php.ini), malicious attackers can read \narbitrary directory lists. \n \nProof of Concept \n================ \n1) http://[victim]/scm/controller.php?group_id=[number] \n&dir=/cvsroot/[project]/CVSROOT/../../../../../ \n \n2) http://[victim]/scm/controlleroo.php?group_id=[number] \n&dir_name=../../../&hide_attic=0 \n \nSolution \n======== \nUpgrade to GForge 4.x \n \nWorkaround \n========== \nDragos Moinescu suggested the workaround of his module. \n- --- \nmodify $GFORGE/common/include/cvsweb/DirectoryHandler.class \nfunction openDirectory() \n{ \nif($this->__DIR_NAME == \"\" || strstr($this->__DIR_NAME, \"..\")) \n{ \n$this->setError(\"You must provide a valid directory name\"); \nreturn false; \n} \n- --- \n \nBut, above workaround doesn't remove the vulnerability in controller.php (by \nRonald Petty). \n \nYou can restrict users to use only cvsweb. \nmodify $GFORGE/www/scm/index.php (follow this step). \n1) find '<a href=\"/scm/controller.php' and delete the found line. \n2) find '<a href=\"/scm/controlleroo.php' and delete the found line. \n3) delete controller.php, controlleroo.php, viewFile.php. \n \nVendor URL \n========== \nhttp://www.gforge.org/ \n \nCredits \n====== \nJeremy Bae at STG Security \n`\n", "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1647405596}}