[UNIX] GForge Directory Traversal Vulnerability

From: SecuriTeam (support_at_securiteam.com)
Date: 01/23/05

  • Next message: SecuriTeam: "[NEWS] Vulnerability in Cisco IOS Embedded Call Processing Solutions" 
    To: list@securiteam.com
Date: 23 Jan 2005 16:23:30 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      GForge Directory Traversal Vulnerability
    ------------------------------------------------------------------------

    SUMMARY

     <http://gforge.org/> GForge has "tools to help your team collaborate,
    like message forums and mailing lists; tools to create and control access
    to Source Code Management repositories like CVS and Subversion. GForge
    automatically creates a repository and controls access to it depending on
    the role settings of the project".

    GForge's CVS modules contains a directory traversal vulnerability that can
    be used to access arbitrary files that are stored on the server.

    DETAILS

    Vulnerable Systems:
     * GForge version 3.3 and prior

    Immune Systems:
     * GForge version 4.0 or newer

    GForge CVS module made by Dragos Moinescu and another module made by
    Ronald Petty both contain a directory traversal vulnerability. Both these
    vulnerabilities manifest themselves only if register_globals has been set
    to on.

    Vulnerable code:
    In the file controller.php the following code can be seen:
    if(!$dir) {
      $dir = $cvsroot;
      $files = retrieveDir($dir);
    ..snip...
    } else {
      $files = retrieveDir($dir);

    As you probably noticed, the $dir variable doesn't get sanitized.

    The same happens inside the controlleroo.php file, the $dir_name variable
    doesn't get sanitized.
    $DIRNAME = ($dir_name != "")?"/$dir_name":"";
    $DIRNAME = $CVSROOT.$DIRNAME;
    $DIRPATH = explode("/",$dir_name);
    echo("Current directory: ");
    for($i=0;$i<count($DIRPATH);$i++)
    {
    ..snip...
    if(false === ($dirContent = $DHD->readDirectory($DIRNAME)))
      echo("Error: ".$DHD->getError());
    ..snip...
    foreach($dirContent AS $k=>$v)
    {
    ..snip...
    $fileLink = ...snip...

    Proof of Concepts:
    http://[victim]/scm/controller.php?group_id=[number]&dir=/cvsroot/[project]/CVSROOT/../../../../../
    http://[victim]/scm/controlleroo.php?group_id=[number]&dir_name=../../../&hide_attic=0

    Workaround:
    Dragos Moinescu suggested the workaround of his module.
    modify $GFORGE/common/include/cvsweb/DirectoryHandler.class
    function openDirectory()
    {
      if($this->__DIR_NAME == "" || strstr($this->__DIR_NAME, ".."))
      {
        $this->setError("You must provide a valid directory name");
        return false;
      }

    Disclosure Timeline:
    2004-12-28 Vulnerability found
    2004-12-28 Developers (Dragos Moinescu, Ronald Petty) contacted and
    confirmed
    2004-12-28 Dragos Moinescu suggested the workaround of his module
    2004-12-29 Vendor contacted
    2005-01-20 Official release

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:advisory@stgsecurity.com>
    SSR Team.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NEWS] Vulnerability in Cisco IOS Embedded Call Processing Solutions"

    Relevant Pages