Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Web Wiz Rich Text Editor Input Validation Flaw Lets Remote Users Traverse the Directory and Create HTML Files
|
|
SecurityTracker Alert ID: 1019267
|
|
SecurityTracker URL: http://securitytracker.com/id?1019267
|
|
CVE Reference: CVE-2008-0466
, CVE-2008-0473
, CVE-2008-0481
(Links to External Site)
|
Updated: Feb 1 2008
|
Original Entry Date: Jan 25 2008
|
Impact: Disclosure of system information, Disclosure of user information, Modification of user information
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): 4.0
|
Description: AmnPardaz Security Research Team reported a vulnerability in Web Wiz Rich Text Editor. A remote user can view files on the target system. A remote user can create HTML files on the target system.
The 'RTE_file_browser.asp' script does not properly validate user-supplied input. A remote user can supply a specially crafted request
to view files on target system that are located outside of the intended directory.
A demonstration exploit URL is provided:
http://[target]/RTE_file_browser.asp?loo
k=save&sub=\.....\\\.....\\\.....\\\.....\\\.....\\\
A remote user can also exploit the 'RTE_popup_save_file.asp' script to create
HTML files on the target system.
The original advisory is available at:
http://www.bugreport.ir/?/31
|
Impact: A remote user can view files on the target system.
A remote user can create HTML files on the target system.
|
Solution: The vendor has issued a fixed version (4.01).
|
Vendor URL: www.webwizguide.com/webwizrichtexteditor/ (Links to External Site)
|
Cause: Access control error, Input validation error
|
Underlying OS: Windows (Any)
|
Reported By: admin@bugreport.ir
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 23 Jan 2008 11:06:27 +0330
From: admin@bugreport.ir
Subject: Web Wiz Rich Text Editor Directory traversal + HTM/HTML file
|
########################## WwW.BugReport.ir
###########################################
# AmnPardaz Security Research Team
# Title: Web Wiz Rich Text Editor(TM)
# Vendor: http://www.webwizguide.com/
# Bug: Directory traversal + HTM/HTML file creation on the server
# Vulnerable Version: 4.0
# Exploit: Available
# Fix Available: No! Fast Solution is available.
###################################################################################
####################
- Description:
####################
Web Wiz Rich Text Editor (RTE) is a free WYSIWYG HTML Rich Text Editor
that replaces standard textarea's with an advanced Word style HTMLarea.
####################
- Vulnerability:
####################
Input passed to the FolderName parameter in "RTE_file_browser.asp" is
not properly sanitised before being used. This can be exploited to
list directories, list txt and list zip files through directory
traversal attacks.
Also, "RTE_file_browser.asp" does not check user's session and an
unauthenticated attacker can perform this attack.
Moreover, by using "RTE_popup_save_file.asp" attacker can make his/her
HTML or HTM file on the server, so this can be used in XSS attacks or
making fake pages.
-POC:
http://[WebWiz
RTE]/RTE_file_browser.asp?look=save&sub=\.....\\\.....\\\.....\\\.....\\\.....\\\
http://[WebWiz RTE]/RTE_popup_save_file.asp
####################
- Fast Solution :
####################
1- You can see below lines in "RTE_file_browser.asp"
'Stip path tampering for security reasons
strSubFolderName = Replace(strSubFolderName, "../", "", 1, -1, 1)
strSubFolderName = Replace(strSubFolderName, "..\", "", 1, -1, 1)
strSubFolderName = Replace(strSubFolderName, "./", "", 1, -1, 1)
strSubFolderName = Replace(strSubFolderName, ".\", "", 1, -1, 1)
Only add this to them:
strSubFolderName = Replace(strSubFolderName, "/", "\", 1, -1, 1)
strSubFolderName = Replace(strSubFolderName, "\\", "\", 1, -1, 1)
strSubFolderName = Replace(strSubFolderName, "..", "", 1, -1, 1)
2- Rename "RTE_popup_save_file.asp" till main solution by vendor
####################
- Credit :
####################
Original Advisory: http://www.bugreport.ir/?/31
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
WwW.BugReport.ir
WwW.AmnPardaz.com
|
|
Go to the Top of This SecurityTracker Archive Page
|
