Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:18603
HistoryDec 09, 2007 - 12:00 a.m.

Limited upload directory traversal in HTTP File Server 2.2a / 2.3 beta (build #146)

2007-12-0900:00:00
vulners.com
31

#######################################################################

                         Luigi Auriemma

Application: HTTP File Server
http://www.rejetto.com/hfs/
Versions: <= 2.2a and <= 2.3 beta (build #146)
Platforms: Windows
Bug: limited directory traversal in files uploading
Exploitation: remote
Date: 05 Dec 2007
Author: Luigi Auriemma
e-mail: [email protected]
web: aluigi.org

#######################################################################

1) Introduction
2) Bug
3) The Code
4) Fix

#######################################################################

===============
1) Introduction

HFS is a very nice and small file server for Windows easy to use and
with many interesting features.

#######################################################################

======
2) Bug

HFS allows the uploading of files to the real folders added to the
Virtual File System.
The problem is that an attacker can upload files outside the
destination folder reaching the root or any other directory on the disk
in which is located the upload folder using the …/ pattern.

Note that uploading must be enabled on the target folder, that the
attacker must have access to it (is possible to restrict the access to
that folder to a specific account) and that is not possible to
overwrite existing files because the server avoids it (for example if a
file called file.txt already exists the new one will be called
file(1).txt).

#######################################################################

===========
3) The Code

http://aluigi.org/testz/myhttpup.zip

myhttpup http://SERVER/folder file.txt …/…/…/file.txt

#######################################################################

======
4) Fix

2.2b #150 and 2.3 beta #160

#######################################################################


Luigi Auriemma
http://aluigi.org