Cloupia Framework E2E - Directory Traversal Vulnerability

Document Title:
===============
Cloupia Framework E2E - Directory Traversal Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=182

ID: KUSTODIAN-2011-011


Release Date:
=============
2012-01-11


Vulnerability Laboratory ID (VL-ID):
====================================
383


Common Vulnerability Scoring System:
====================================
7.8


Product & Service Introduction:
===============================
Provides end-to-end FlexPod management and automation across physical, virtual, compute, storage and network resources. 
Create internal private clouds rapidly with internal standards and procedures to maximize the infrastructure investments. 
Provides comprehensive physical and virtual infrastructure management and automation. Provides unified solution and single 
pane of glass for consistent and connected experience across private, public & hybrid clouds.


Abstract Advisory Information:
==============================
A Laboratory Researcher (Chris Rock) discovered a directory traversal vulnerability on the famous Cloupia Application Framework.


Vulnerability Disclosure Timeline:
==================================
2012-01-16:	Public or Non-Public Disclosure


Discovery Status:
=================
Published


Exploitation Technique:
=======================
Remote


Severity Level:
===============
High


Technical Details & Description:
================================
jQuery File Tree is a configurable, AJAX file browser plugin for the jQuery javascript library utilised within the Cloupia application framework. 
Unauthenticated access to this module allows a remote attacker to browse the entire file system of the host server, beyond the 
realm of the web service itself. Cloupia are aware of this flaw and are releasing a patch to mitigate access. End users are 
urged to update immediately by contacting the vendor.


Proof of Concept (PoC):
=======================
The directory traversal vulnerability can b exploited by local & remote attackers. For demonstration or reproduce ...

The following process performed as an attacker to exploit this vulnerability would be as follows. The code for the jQuery File 
Tree ‘Java-Server-Page’ file reads as follows ...

<%@ page
	import="java.io.File,java.io.FilenameFilter,java.util.Arrays"%>
<%
/**
  * jQuery File Tree JSP Connector
  * Version 1.0
  * Copyright 2008 Joshua Gould
  * 21 April 2008
*/	
    String dir = request.getParameter("dir");
    if (dir == null) {
    	return;
    }
	
	if (dir.charAt(dir.length()-1) == '\\') {
    	dir = dir.substring(0, dir.length()-1) + "/";
	} else if (dir.charAt(dir.length()-1) != '/') {
	    dir += "/";
	}
    if (new File(dir).exists()) {
		String[] files = new File(dir).list(new FilenameFilter() {
		    public boolean accept(File dir, String name) {
				return name.charAt(0) != '.';
		    }
		});
		Arrays.sort(files, String.CASE_INSENSITIVE_ORDER);
		out.print("<ul class=\"jqueryFileTree\" style=\"display: none;\">");
		// All dirs
		for (String file : files) {
		    if (new File(dir, file).isDirectory()) {
				out.print("<li class=\"directory collapsed\"><a href=\"#\" rel=\"" + dir + file + "/\">"
					+ file + "</a></li>");
		    }
		}
		// All files
		for (String file : files) {
		    if (!new File(dir, file).isDirectory()) {
				int dotIndex = file.lastIndexOf('.');
				String ext = dotIndex > 0 ? file.substring(dotIndex + 1) : "";
				out.print("<li class=\"file ext_" + ext + "\"><a href=\"#\" rel=\"" + dir + file + "\">"
					+ file + "</a></li>");
		    	}
		}
		out.print("</ul>");
    }
%>


By using the ‘dir’ variable in an HTTP POST request, along with the desired file path, the directory structure is returned in XML format.


Security Risk:
==============
The security risk of the directory traversal web vulnerability is estimated as high(+).


Credits & Authors:
==================
Chris Rock - Kustodian [www.Kustodian.com]



Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       - www.vulnerability-lab.com/register
Contact:    [email protected] 	- [email protected] 	       - [email protected]
Section:    video.vulnerability-lab.com 	- forum.vulnerability-lab.com 		       - news.vulnerability-lab.com
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       - youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   - vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and 
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), 
modify, use or edit our material contact ([email protected] or [email protected]) to get a permission.

    				   	Copyright © 2012 | Vulnerability Laboratory