OXID eShop CE 4.9.7 Path Traversal / Privilege Escalation Vulnerabilities

ID 1337DAY-ID-25277
Type zdt
Reporter Tim Herres
Modified 2016-05-04T00:00:00


OXID eShop Community Edition version 4.9.7 suffers from path traversal and privilege escalation vulnerabilities.

                                            OXID eShop Path Traversal Vulnerability

Affected Versions
Community Edition 4.9.7

Issue Overview
Vulnerability Type: path traversal, privilege escalation
Version: Tested in Community Edition 4.9.7
Technical Risk: high
Likelihood of Exploitation: medium
Vendor: OXID eSales AG
Vendor URL: https://www.oxid-esales.com
Credits: LSE Leading Security Experts GmbH employee Tim Herres
Advisory URL: https://www.lsexperts.de/advisories/lse-2016-02-03.txt
Advisory Status: Public
CVE-Number: NA
CVSS 2.0: 3.5  (AV:N/AC:M/Au:S/C:P/I:N/A:N)

A missing file path validation allows an authenticated user with permission
to add or edit products to read any file on the file system without permissions.

Issue Description
While conducting an internal evaluation of the software, LSE Leading
Security Experts GmbH discovered a path traversal vulnerability in the product
downloads function. A user with permissions to change or add products may change
the Downloads name to a local file (e.g. "../../../config.inc.php"). This may lead
to a privilege escalation.

Temporary Workaround and Fix
Install latest update 4.9.8/5.2.8
See http://wiki.oxidforge.org/Downloads/4.9.8_5.2.8

Proof of Concept
Create a new product in the backend. In the "Downloads" tab set "name of the uploaded
file" to "../../../config.inc.php". Go to the frontend and buy the related product.
Move to "My account" and choose the download section. Download the file and enjoy
full database credentials.

2016-02-05 Issue discovered
2016-02-22 Vendor contacted
2016-02-24 Vendor confirmed
2016-05-03 Vendor released patch
2016-05-03 Advisory release

#  0day.today [2016-05-05]  #