[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 3 May 2016 18:40:24 +0200
From: LSE-Advisories <advisories@...xperts.de>
To: bugtraq@...urityfocus.com, oss-security@...ts.openwall.com,
submissions@...ketstormsecurity.org, fulldisclosure@...lists.org,
bugs@...uritytracker.com
Subject: LSE Leading Security Experts GmbH - LSE-2016-02-03 - OXID eShop Path
Traversal Vulnerability
=== LSE Leading Security Experts GmbH - Security Advisory 2016-02-03 ===
OXID eShop Path Traversal Vulnerability
------------------------------------------------------------------------
Affected Versions
=================
Community Edition 4.9.7
Issue Overview
==============
Vulnerability Type: path traversal, privilege escalation
Version: Tested in Community Edition 4.9.7
Technical Risk: high
Likelihood of Exploitation: medium
Vendor: OXID eSales AG
Vendor URL: https://www.oxid-esales.com
Credits: LSE Leading Security Experts GmbH employee Tim Herres
Advisory URL: https://www.lsexperts.de/advisories/lse-2016-02-03.txt
Advisory Status: Public
CVE-Number: NA
CVE URL: NA
OVE-ID:OVE-20160419-0002
OVI-ID:OVI-2016-7988
CWE-ID: CWE-22
CVSS 2.0: 3.5 (AV:N/AC:M/Au:S/C:P/I:N/A:N)
Impact
======
A missing file path validation allows an authenticated user with permission
to add or edit products to read any file on the file system without permissions.
Issue Description
=================
While conducting an internal evaluation of the software, LSE Leading
Security Experts GmbH discovered a path traversal vulnerability in the product
downloads function. A user with permissions to change or add products may change
the Downloads name to a local file (e.g. "../../../config.inc.php"). This may lead
to a privilege escalation.
Temporary Workaround and Fix
============================
Install latest update 4.9.8/5.2.8
See http://wiki.oxidforge.org/Downloads/4.9.8_5.2.8
Proof of Concept
================
Create a new product in the backend. In the "Downloads" tab set "name of the uploaded
file" to "../../../config.inc.php". Go to the frontend and buy the related product.
Move to "My account" and choose the download section. Download the file and enjoy
full database credentials.
History
=======
2016-02-05 Issue discovered
2016-02-22 Vendor contacted
2016-02-24 Vendor confirmed
2016-05-03 Vendor released patch
2016-05-03 Advisory release
GPG Signature
=============
This advisory is signed with the GPG key of the
LSE Leading Security Experts GmbH advisories team.
The key can be downloaded here: https://www.lsexperts.de/advisories-key-99E3277C.asc
Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
