ExplorerXP Input Validation Hole Permits Directory Traversal and Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1015840
|
|
SecurityTracker URL: http://securitytracker.com/id?1015840
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Mar 28 2006
|
Impact: Disclosure of authentication information, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Exploit Included: Yes
|
Description: Amine ABOUD (Silitix) reported a vulnerability in ExplorerXP. A remote user can conduct cross-site scripting attacks. A remote user can also view files on the target system.
The 'dir.php' script does not properly validate user-supplied filenames in the 'chemin' parameter. A remote user can supply a specially
crafted parameter value containing '../' directory traversal parameters to view arbitrary files on the target system.
A demonstration
exploit URL is provided:
http://[target]/dir.php?chemin=../../../
The 'dir.php' script also does not properly filter HTML
code from user-supplied input in the 'chemin' parameter before displaying the input. A remote user can create a specially crafted
URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code
will originate from the site running the ExplorerXP software and will run in the security context of that site. As a result, the
code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access
data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
A
demonstration exploit URL is provided:
http://[target]/dir.php?chemin=../<b>Silitix
|
Impact: A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the
ExplorerXP software, access data recently submitted by the target user via web form to the site, or take actions on the site acting
as the target user.
A remote user can view arbitrary files on the target system.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.explorerxp.com/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Windows (2000), Windows (XP)
|
Reported By: Silitix <silitix@gmail.com>
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 28 Mar 2006 04:49:56 +0100
From: Silitix <silitix@gmail.com>
Subject: Avis de securite : ExplorerXP : Directory Traversal & Cross Scripting Site
|
ExplorerXP : ( all version )
Langage : PHP
Problème : Directory Traversal & Cross Site Scripting ( XSS )
Description :
ExploreXP consiste à visualiser l'arborescence des fichiers et répertoires à partir
d'un répertoire donné. En tout 2 fichiers
php (10KB) et un réperoire images. Un explorateur de fichiers très simple à mettre en
oeuvre. Il possède en plus un design
"Windows XP".
L'installation est très facile, il suffit de télécharger le fichier compressé, de le
décompressé et de déposer les 2 fichiers
php + le répertoire d'images dans un répertoire quelconque. Faire pointer ensuite son
navigateur sur /repertoire/dir.php et
le tour est joué.
Exploitation :
Directory Traversal : http://[target]/dir.php?chemin=../../../
Cross Site Scripting : http://[target]/dir.php?chemin=../<b>Silitix
Screenshoot disponobile sur l'avis de sécurité original.
Original Advisories : www.Silitix.com/explorerxp.php
Exemple : http://www.ligue94.org/explor/dir.php?chemin=../../../../../../../../../etc/
Crédits
Auteur : Amine ABOUD aka Silitix
E-mail : admin@silitix.com
Website : http://www.Silitix.com
|
|
