Rapid7 Security Advisory 36

`R7-0036: FCKEditor.NET File Upload Code Execution  
August 30, 2010  
  
-- Vulnerability Details:  
  
FCKEditor contains a file renaming bug that allows remote code execution. Specifically, it is possible to upload ASP code via the ASP.NET connector in FCKEditor. The vulnerability requires that the remote server be running IIS. This vulnerability has been confirmed on FCKEditor 2.5.1 and 2.6.6.  
  
CVSS Vector: AV:R/AC:L/Au:NR/C:C/I:C/A:C  
  
Browse to http://<ip>fckeditor/editor/filemanager/connectors/test.html and choose the ASP.NET connector. By uploading a file with the same name as an existing file, that includes an underscore followed by a dot, it is possible to bypass the file renaming mitigation in place. For instance, when uploading a file twice with the name:  
  
myfile_.asp;.txt  
  
The first file would be renamed  
  
myfile__asp;.txt  
  
BUT the second file will be renamed  
  
myfile_.asp;(1).txt  
  
Due to the IIS semi-colon vulnerability (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4444) the server will remotely execute myfile_.asp;(1).txt when the second file is accessed.  
  
  
-- Vendor Response:  
A new version of the .NET connector has been released to address this issue, it can be found at the URL below.  
  
http://ckeditor.com/blog/FCKeditor.Net_2.6.4_released  
  
-- Disclosure Timeline:  
2010-08-17 - Vulnerability reported to the vendor via contact form  
2010-08-17 - Vulnerability reported to the vendor via bug tracker  
2010-08-19 - Vulnerability reported to the vendor via email  
2010-08-27 - Vendor replied indicating a fix is in the works  
2010-08-27 - Vendor schedules the fix for August 30th, 2010  
2010-08-30 - Vendor releases version 2.6.4 to address the issue  
  
-- Credit:  
This vulnerability was discovered by Will Vandevanter of the Rapid7 professional services team during a customer engagement.  
  
-- About Rapid7 Security  
Rapid7 provides vulnerability management, compliance and penetration testing solutions for Web application, network and database security. In addition to developing the NeXpose Vulnerability Management system, Rapid7 manages the Metasploit Project and is the primary sponsor of the  
W3AF web assessment tool.   
  
Our vulnerability disclosure policy is available online at:  
  
http://www.rapid7.com/disclosure.jsp  
  
  
  
`