SmarterMail 7.1.3876 Directory Traversal

` Vendor: smartertools.com SmarterMail 7.x (7.1.3876) | Bug : Directory  
Traversal, OS Command Injection, Other Critcal Vulns  
########################################################################  
  
# Vendor: smartertools.com SmarterMail 7.x (7.1.3876)  
# Date: 2010-09-12  
# Author : sqlhacker – http://cloudscan.me  
# Thanks to : Burp Suite Pro - engagement tool  
# : FuzzDB  
# Contact : [email protected]  
# Home : http://cloudscan.me  
# Dork : insite: SmarterMail Enterprise 7.1  
# Bug : Directory Traversal, OS Command Injection, Other Critcal Vulns  
# Tested on : SmarterMail 7.x (7.1.3876) // Windows 2008 /64/R2  
# Vendor Contact - August 14, 2010  
# -Multiple email exchanges with Vendor thru Labor Day 2010  
# - Vendor took no action 9/1/2010  
# - Public Disclosure with Workaround Solution Provided 9-4-2010  
########################################################################  
Source URL  
http://cloudscan.blogspot.com/2010/09/smarter-stats-533819-file-fuzzing.html  
  
The default installation of SmarterMail is vulnerable to 1 (or more) of the  
file fuzzing types contained within FuzzDB and Burp Suite Pro 1.3.08 as a  
baseline analysis for exploit surface modeling.  
  
Reduced to exploits, Directory Traversal, OS Injection and Execution.  
Initial Exploit Requires user-level privs.  
  
A malicious user seeking to exploit Browser Clients can launch attacks from  
the User Home / Public Web Directory utilizing the SSL Certificate of the  
Host Provider.  
A malicious user seeking to exploit the Host Server can launch attacks as  
Local File Inclusion or Remote File Inclusion and perform Operating System  
Injections and Execution.  
A malicious user can read and write directories, files and perform malicious  
operations due to the default configuration of smartermail.  
  
  
This is reduced to: GET {Vulnerable SmarterMail  
Site}/path/*payload*relative/path/to/target/file/  
..%255c  
.%5c../..%5c  
/..%c0%9v../  
/..%c0%af../  
/..%255c..%255c  
../../../../../../win.ini  
../../../../../../SmarterMail/ExploitShells  
../../../../../../SmarterMail/{Domain}/{(l)uzername)/PubPayloadDir/logo_25.jpg%../%../somewhere  
to read/write  
A workaround is posted in the Source URL  
http://cloudscan.blogspot.com/2010/09/smarter-stats-533819-file-fuzzing.html  
  
`