[UNIX] GForge Directory Traversal Vulnerability
From: SecuriTeam (support_at_securiteam.com)
Date: 01/23/05
- Previous message: SecuriTeam: "[NT] RealPlayer Miscellaneous Vulnerabilities (RMP, RJS)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: list@securiteam.com Date: 23 Jan 2005 16:23:30 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
GForge Directory Traversal Vulnerability
------------------------------------------------------------------------
SUMMARY
<http://gforge.org/> GForge has "tools to help your team collaborate,
like message forums and mailing lists; tools to create and control access
to Source Code Management repositories like CVS and Subversion. GForge
automatically creates a repository and controls access to it depending on
the role settings of the project".
GForge's CVS modules contains a directory traversal vulnerability that can
be used to access arbitrary files that are stored on the server.
DETAILS
Vulnerable Systems:
* GForge version 3.3 and prior
Immune Systems:
* GForge version 4.0 or newer
GForge CVS module made by Dragos Moinescu and another module made by
Ronald Petty both contain a directory traversal vulnerability. Both these
vulnerabilities manifest themselves only if register_globals has been set
to on.
Vulnerable code:
In the file controller.php the following code can be seen:
if(!$dir) {
$dir = $cvsroot;
$files = retrieveDir($dir);
..snip...
} else {
$files = retrieveDir($dir);
As you probably noticed, the $dir variable doesn't get sanitized.
The same happens inside the controlleroo.php file, the $dir_name variable
doesn't get sanitized.
$DIRNAME = ($dir_name != "")?"/$dir_name":"";
$DIRNAME = $CVSROOT.$DIRNAME;
$DIRPATH = explode("/",$dir_name);
echo("Current directory: ");
for($i=0;$i<count($DIRPATH);$i++)
{
..snip...
if(false === ($dirContent = $DHD->readDirectory($DIRNAME)))
echo("Error: ".$DHD->getError());
..snip...
foreach($dirContent AS $k=>$v)
{
..snip...
$fileLink = ...snip...
Proof of Concepts:
http://[victim]/scm/controller.php?group_id=[number]&dir=/cvsroot/[project]/CVSROOT/../../../../../
http://[victim]/scm/controlleroo.php?group_id=[number]&dir_name=../../../&hide_attic=0
Workaround:
Dragos Moinescu suggested the workaround of his module.
modify $GFORGE/common/include/cvsweb/DirectoryHandler.class
function openDirectory()
{
if($this->__DIR_NAME == "" || strstr($this->__DIR_NAME, ".."))
{
$this->setError("You must provide a valid directory name");
return false;
}
Disclosure Timeline:
2004-12-28 Vulnerability found
2004-12-28 Developers (Dragos Moinescu, Ronald Petty) contacted and
confirmed
2004-12-28 Dragos Moinescu suggested the workaround of his module
2004-12-29 Vendor contacted
2005-01-20 Official release
ADDITIONAL INFORMATION
The information has been provided by <mailto:advisory@stgsecurity.com>
SSR Team.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Previous message: SecuriTeam: "[NT] RealPlayer Miscellaneous Vulnerabilities (RMP, RJS)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
