shttp004-traverse.txt

`The most recent version of this advisory (including any updates) is  
available at:  
http://www.digineo.co.uk/shttp_directory_traversal  
  
Directory Traversal Flaw in shttp  
---------------------------------  
Affected product: shttp  
Product vendor: Vito Caputo - (http://serverkit.org/modules/contrib/shttp/)  
Affected version: 0.0.4  
  
Product description  
-------------------  
Shttp is a partial implementation of HTTP/1.1. It does not strictly follow  
the RFC but works well enough to serve static content for  
personal/experimental/educational use. The module consists of just over 1000  
LoC making it an excellent example of what can be done with ServerKit with  
little effort and a great learning tool for those getting started with  
ServerKit programming.  
  
  
Problem analysis  
----------------  
While examining the source code of shttp.c, it was noted that the  
safe_path(char *path) function does not entirely prevent directory traversal  
attacks. The affected function analyses the supplied URI and returns a value  
indicating the folder distance from the document root. Positive return  
values indicate child folders, negative values indicate parent folders and  
hence directory traversal attempts. However, the function does not trap  
directory traversal attacks where the target file is deeper within the  
folder hierarchy than the web document root.  
  
  
Problem example  
---------------  
Assuming that the product has been installed with the default document root  
(/var/www), the following demonstrates the problem:  
  
HEAD /../../etc/passwd HTTP/1.0  
  
HTTP/1.1 400 Bad Request  
Content-Type: text/html  
Server: Shttp/ServerKit  
Date: Thu, 25 Oct 2007 16:31:30 GMT  
Connection: close  
  
  
HEAD /../../var/log/messages HTTP/1.0  
  
HTTP/1.1 200 OK  
Content-Length: 178455  
Content-Type: text/plain  
Last-Modified: Thu, 25 Oct 2007 16:36:39 GMT  
Server: Shttp/ServerKit  
Date: Thu, 25 Oct 2007 16:42:32 GMT  
Connection: close  
  
  
Rectification  
-------------  
This issue has been addressed and rectified in version 0.0.5 of shttp,  
available from http://serverkit.org/modules/contrib/shttp/.  
digineo thanks Vito Caputo for his assistance and rapid response with  
regards to this issue.  
  
  
Discovery timeline  
------------------  
20071024 - Issue discovered  
20071025 - Vendor notified  
20071025 - Vendor response  
20071025 - Update released  
20071026 - Advisory published  
  
  
--   
Pete Foster  
digineo Limited  
`