{"id": "PACKETSTORM:35838", "type": "packetstorm", "bulletinFamily": "exploit", "title": "STG Security Advisory 2005-01-20.24", "description": "", "published": "2005-01-25T00:00:00", "modified": "2005-01-25T00:00:00", "cvss": {"vector": "NONE", "score": 0.0}, "href": "https://packetstormsecurity.com/files/35838/STG-Security-Advisory-2005-01-20.24.html", "reporter": "STG Security", "references": [], "cvelist": [], "lastseen": "2016-11-03T10:22:14", "viewCount": 18, "enchantments": {"score": {"value": 0.5, "vector": "NONE"}, "dependencies": {}, "backreferences": {}, "exploitation": null, "vulnersScore": 0.5}, "sourceHref": "https://packetstormsecurity.com/files/download/35838/SSA-20050120-24.txt", "sourceData": "` \n \nSTG Security Advisory: [SSA-20050120-24] GForge 3.x directory traversal \nvulnerability. \n \nRevision 1.0 \nDate Published: 2005-01-20 (KST) \nLast Update: 2005-01-20 (KST) \nDisclosed by SSR Team (advisory@stgsecurity.com) \n \nSummary \n======== \nGForge is a software to help collaborative development for software \ncommunities. The software provides a full configured development system with \ntools for communication and version control among members of a development \nteam on a web site. GForge CVS modules have a directory traversal \nvulnerability exploited by malicious attackers. \n \nVulnerability Class \n=================== \nImplementation Error: Input validation flaw \n \nImpact \n====== \nLow : arbitrary directory list disclosure. \n \nAffected Products \n================ \nGForge 3.3 and prior \n \nNot Affected Products \n===================== \nGForge 4.0 and posterior \n \nVendor Status: FIXED (GForge 4.0) \n==================== \n2004-12-28 Vulnerability found \n2004-12-28 Developers (Dragos Moinescu, Ronald Petty) contacted and \nconfirmed. \n2004-12-28 Dragos Moinescu suggested the workaround of his module. \n2004-12-29 Vendor contacted. \n2005-01-20 Official release. \n \nDetails \n======= \nGForge CVS module made by Dragos Moinescu and another module made by Ronald \nPetty have a directory traversal vulnerability. \n \n$GFORGE/www/scm/controller.php doesn't sanitize $dir variable. \n- --- \nif(!$dir) { \n$dir = $cvsroot; \n$files = retrieveDir($dir); \n...snip... \n} else { \n$files = retrieveDir($dir); \n- --- \n \n$GFORGE/www/scm/controlleroo.php doesn't sanitize $dir_name variable. \n- --- \n$DIRNAME = ($dir_name != \"\")?\"/$dir_name\":\"\"; \n$DIRNAME = $CVSROOT.$DIRNAME; \n$DIRPATH = explode(\"/\",$dir_name); \necho(\"Current directory: \"); \nfor($i=0;$i<count($DIRPATH);$i++) \n{ \n...snip... \nif(false === ($dirContent = $DHD->readDirectory($DIRNAME))) \necho(\"Error: \".$DHD->getError()); \n...snip... \nforeach($dirContent AS $k=>$v) \n{ \n...snip... \n$fileLink = ...snip... \n- --- \n \nIf register_globals = On (in php.ini), malicious attackers can read \narbitrary directory lists. \n \nProof of Concept \n================ \n1) http://[victim]/scm/controller.php?group_id=[number] \n&dir=/cvsroot/[project]/CVSROOT/../../../../../ \n \n2) http://[victim]/scm/controlleroo.php?group_id=[number] \n&dir_name=../../../&hide_attic=0 \n \nSolution \n======== \nUpgrade to GForge 4.x \n \nWorkaround \n========== \nDragos Moinescu suggested the workaround of his module. \n- --- \nmodify $GFORGE/common/include/cvsweb/DirectoryHandler.class \nfunction openDirectory() \n{ \nif($this->__DIR_NAME == \"\" || strstr($this->__DIR_NAME, \"..\")) \n{ \n$this->setError(\"You must provide a valid directory name\"); \nreturn false; \n} \n- --- \n \nBut, above workaround doesn't remove the vulnerability in controller.php (by \nRonald Petty). \n \nYou can restrict users to use only cvsweb. \nmodify $GFORGE/www/scm/index.php (follow this step). \n1) find '<a href=\"/scm/controller.php' and delete the found line. \n2) find '<a href=\"/scm/controlleroo.php' and delete the found line. \n3) delete controller.php, controlleroo.php, viewFile.php. \n \nVendor URL \n========== \nhttp://www.gforge.org/ \n \nCredits \n====== \nJeremy Bae at STG Security \n`\n", "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1647405596}}
{}
STG Security Advisory 2005-01-20.24