137 lines
No EOL
4.4 KiB
Text
137 lines
No EOL
4.4 KiB
Text
Advisory: Directory Traversal in DevExpress ASP.NET File Manager
|
|
|
|
During a penetration test RedTeam Pentesting discovered a directory
|
|
traversal vulnerability in DevExpress' ASP.NET File Manager and File
|
|
Upload. Attackers are able to read arbitrary files by specifying a
|
|
relative path.
|
|
|
|
Details
|
|
=======
|
|
|
|
Product: DevExpress ASPxFileManager Control for WebForms and MVC
|
|
Affected Versions: DevExpress ASPxFileManager v10.2 to v13.2.8
|
|
Fixed Versions: DevExpress ASPxFileManager v13.2.9
|
|
Vulnerability Type: Directory Traversal
|
|
Security Risk: high
|
|
Vendor URL:
|
|
https://www.devexpress.com/Products/NET/Controls/ASP/File-Upload-Explorer/
|
|
Vendor Status: fixed version released
|
|
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2014-006
|
|
Advisory Status: published
|
|
CVE: CVE-2014-2575
|
|
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2575
|
|
|
|
|
|
Introduction
|
|
============
|
|
|
|
"The DevExpress ASP.NET Subscription includes a standalone Multi-File
|
|
Upload Manager for WebForms and MVC and a pre-built File Manager for
|
|
WebForms; built so you can instantly introduce file management
|
|
capabilities in your next web application."
|
|
|
|
(from DevExpress' Homepage)
|
|
|
|
|
|
More Details
|
|
============
|
|
|
|
The ASPX File Manager component is prone to a directory traversal
|
|
vulnerability. Attackers with access to the File Manager component can
|
|
read arbitrary files on the same partition as the shared directory.
|
|
|
|
A common request to download a file via the File Manager component
|
|
requires multiple HTTP-Post parameters:
|
|
|
|
__EVENTTARGET=ctl00%24ContentPlaceHolder1%24ASPxFileManager1
|
|
__EVENTARGUMENT=13%7C<file.ext>
|
|
__EVENTVALID=
|
|
|
|
The parameter __EVENTARGUMENT=13|<file.ext> specifies a file download
|
|
and the file which is to be downloaded. Attackers may also request files
|
|
outside of the shared directory by prepending a relative path to a
|
|
parent directory.
|
|
|
|
|
|
Proof of Concept
|
|
================
|
|
|
|
By requesting files with a relative path, files otherwise not available
|
|
will be accessible through the File Manager component. Depending on the
|
|
shared directory and the webserver configuration, the webserver
|
|
configuration file might for example be accessible through the File
|
|
Manager component:
|
|
|
|
__EVENTARGUMENT=13|../../web.config
|
|
|
|
Other sensitive operating system files could be affected, too.
|
|
|
|
Example exploit:
|
|
------------------------------------------------------------------------
|
|
curl --data __EVENTTARGET=ctl00%24ContentPlaceHolder1%24ASPxFileManager1\
|
|
"&__EVENTARGUMENT=13%7C../../web.config&=&__EVENTVALID" \
|
|
http://example.com/FileManagerComponent.aspx
|
|
------------------------------------------------------------------------
|
|
|
|
The request above will download the specified file.
|
|
|
|
|
|
Workaround
|
|
==========
|
|
|
|
Instead of a physical file system provider, a database file system
|
|
provider with limited access permissions could be used.
|
|
|
|
|
|
Fix
|
|
===
|
|
|
|
Update ASPxFileManager control to DevExpress libraries version v13.2.9.
|
|
|
|
|
|
Security Risk
|
|
=============
|
|
|
|
The risk is estimated to be high. This vulnerability allows attackers to
|
|
access arbitrary files on the same partition as the File Manager's root
|
|
directory. This may allow attackers to read sensitive information like
|
|
the webserver configuration.
|
|
|
|
|
|
Timeline
|
|
========
|
|
|
|
2014-03-10 Vulnerability identified
|
|
2014-03-21 Customer approved disclosure to vendor
|
|
2014-03-21 CVE number requested and assigned
|
|
2014-03-25 Vendor notified
|
|
2014-04-11 Customer opened support ticket with vendor
|
|
2014-04-17 Vendor released fixed version
|
|
2014-04-17 Vendor released security advisory to customers
|
|
2014-06-05 Advisory released
|
|
|
|
|
|
References
|
|
==========
|
|
|
|
Vendor Security Advisory:
|
|
http://security.devexpress.com/de7c4756/?id=ff8c1703126f4717993ac3608a65a2e2
|
|
|
|
|
|
RedTeam Pentesting GmbH
|
|
=======================
|
|
|
|
RedTeam Pentesting offers individual penetration tests, short pentests,
|
|
performed by a team of specialised IT-security experts. Hereby, security
|
|
weaknesses in company networks or products are uncovered and can be
|
|
fixed immediately.
|
|
|
|
As there are only few experts in this field, RedTeam Pentesting wants to
|
|
share its knowledge and enhance the public knowledge with research in
|
|
security related areas. The results are made available as public
|
|
security advisories.
|
|
|
|
More information about RedTeam Pentesting can be found at
|
|
https://www.redteam-pentesting.de.
|
|
|
|
-- RedTeam Pentesting GmbH Tel.: +49 241 510081-0 Dennewartstr. 25-27 Fax : +49 241 510081-99 52068 Aachen https://www.redteam-pentesting.de Germany Registergericht: Aachen HRB 14004 Geschäftsführer: Patrick Hof, Jens Liebchen |