xennoBB.txt

`--------------------- SUMMARY ---------------------  
  
  
  
Name:  
  
XennoBB "avatar gallery" directory transversal (10/8/2006)  
  
  
  
Vendor / Product:  
  
XennoBB Group  
  
http://www.xennobb.com/  
  
  
  
Description:  
  
The world's most revolutionary and easy to use bulletin board.  
  
  
  
Revolutionary because it redefines the boundaries of usability  
  
and power; from the first version it's a real alternative to  
  
the commercial forums out there.  
  
  
  
How can XennoBB be described in few words?   
  
Lightning-speed, stable, SECURED(?) and modern.  
  
  
  
Version(s) Affected:  
  
<= 2.1.0  
  
  
  
Severity:  
  
Medium  
  
  
  
Impact:  
  
Directory transversal (Remote)  
  
  
  
Status:  
  
Unpatched  
  
  
  
Discovered by:  
  
Chris Boulton <http://www.surfionline.com>  
  
  
  
Original advisory:  
  
http://www.surfionline.com/security_advisories/20060810_xennobb_avatar_gallery_transversal.txt  
  
  
  
------------------- DESCRIPTION -------------------  
  
  
  
An exploit exists in the above mentioned versions of XennoBB which  
  
can be exploited by malicious users to transverse various directories  
  
on the server.  
  
  
  
Input passed to the "gallery" parameter in profile.php is not properly  
  
sanitized before being used to open the corresponding directory on the  
  
file system. This exploit can lead to manipulation of content in higher  
  
up directories than the script intends.  
  
  
  
--------------------- EXPLOIT ---------------------  
  
  
  
Submit a forged POST request to  
  
  
  
profile.php?action=avatar_gallery&id={your registered user ID here}  
  
  
  
With the following as the POST data:  
  
  
  
category=../../general/  
  
  
  
Successful exploitation leads to images in the /img/general folder  
  
being shown to the user. A similar process can be used to obtain other  
  
confidential system documents or images which may exist on the server.  
  
  
  
--------------------- SOLUTION --------------------  
  
  
  
Ensure input is correctly sanitized and invalid/not acceptable  
  
characters are removed from the gallery POST variable before the  
  
directory is opened on the server.  
`