DevExpress ASPxFileManager 10.2 < 13.2.8 - Directory Traversal

• Exploit Database
• 19 阅读

• 作者： RedTeam Pentesting
  日期： 2014-06-09
• 类别：

  • webapps
  平台：

  • asp
• 来源：https://www.exploit-db.com/exploits/33700/

• Advisory: Directory Traversal in DevExpress ASP.NET File Manager
  
  During a penetration test RedTeam Pentesting discovered a directory
  traversal vulnerability in DevExpress' ASP.NET File Manager and File
  Upload. Attackers are able to read arbitrary files by specifying a
  relative path.
  
  Details
  =======
  
  Product: DevExpress ASPxFileManager Control for WebForms and MVC
  Affected Versions: DevExpress ASPxFileManager v10.2 to v13.2.8
  Fixed Versions: DevExpress ASPxFileManager v13.2.9
  Vulnerability Type: Directory Traversal
  Security Risk: high
  Vendor URL:
  https://www.devexpress.com/Products/NET/Controls/ASP/File-Upload-Explorer/
  Vendor Status: fixed version released
  Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2014-006
  Advisory Status: published
  CVE: CVE-2014-2575
  CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2575
  
  
  Introduction
  ============
  
  "The DevExpress ASP.NET Subscription includes a standalone Multi-File
  Upload Manager for WebForms and MVC and a pre-built File Manager for
  WebForms; built so you can instantly introduce file management
  capabilities in your next web application."
  
  (from DevExpress' Homepage)
  
  
  More Details
  ============
  
  The ASPX File Manager component is prone to a directory traversal
  vulnerability. Attackers with access to the File Manager component can
  read arbitrary files on the same partition as the shared directory.
  
  A common request to download a file via the File Manager component
  requires multiple HTTP-Post parameters:
  
  __EVENTTARGET=ctl00%24ContentPlaceHolder1%24ASPxFileManager1
  __EVENTARGUMENT=13%7C<file.ext>
  __EVENTVALID=
  
  The parameter __EVENTARGUMENT=13|<file.ext> specifies a file download
  and the file which is to be downloaded. Attackers may also request files
  outside of the shared directory by prepending a relative path to a
  parent directory.
  
  
  Proof of Concept
  ================
  
  By requesting files with a relative path, files otherwise not available
  will be accessible through the File Manager component.Depending on the
  shared directory and the webserver configuration, the webserver
  configuration file might for example be accessible through the File
  Manager component:
  
  __EVENTARGUMENT=13|../../web.config
  
  Other sensitive operating system files could be affected, too.
  
  Example exploit:
  ------------------------------------------------------------------------
  curl --data __EVENTTARGET=ctl00%24ContentPlaceHolder1%24ASPxFileManager1\
  "&__EVENTARGUMENT=13%7C../../web.config&=&__EVENTVALID" \
  http://example.com/FileManagerComponent.aspx
  ------------------------------------------------------------------------
  
  The request above will download the specified file.
  
  
  Workaround
  ==========
  
  Instead of a physical file system provider, a database file system
  provider with limited access permissions could be used.
  
  
  Fix
  ===
  
  Update ASPxFileManager control to DevExpress libraries version v13.2.9.
  
  
  Security Risk
  =============
  
  The risk is estimated to be high. This vulnerability allows attackers to
  access arbitrary files on the same partition as the File Manager's root
  directory. This may allow attackers to read sensitive information like
  the webserver configuration.
  
  
  Timeline
  ========
  
  2014-03-10 Vulnerability identified
  2014-03-21 Customer approved disclosure to vendor
  2014-03-21 CVE number requested and assigned
  2014-03-25 Vendor notified
  2014-04-11 Customer opened support ticket with vendor
  2014-04-17 Vendor released fixed version
  2014-04-17 Vendor released security advisory to customers
  2014-06-05 Advisory released
  
  
  References
  ==========
  
  Vendor Security Advisory:
  http://security.devexpress.com/de7c4756/?id=ff8c1703126f4717993ac3608a65a2e2
  
  
  RedTeam Pentesting GmbH
  =======================
  
  RedTeam Pentesting offers individual penetration tests, short pentests,
  performed by a team of specialised IT-security experts. Hereby, security
  weaknesses in company networks or products are uncovered and can be
  fixed immediately.
  
  As there are only few experts in this field, RedTeam Pentesting wants to
  share its knowledge and enhance the public knowledge with research in
  security related areas. The results are made available as public
  security advisories.
  
  More information about RedTeam Pentesting can be found at
  https://www.redteam-pentesting.de.
  
  -- RedTeam Pentesting GmbH Tel.: +49 241 510081-0 Dennewartstr. 25-27 Fax : +49 241 510081-99 52068 Aachen https://www.redteam-pentesting.de Germany Registergericht: Aachen HRB 14004 Geschäftsführer: Patrick Hof, Jens Liebchen