75 lines
No EOL
2.5 KiB
Text
75 lines
No EOL
2.5 KiB
Text
============================================================
|
||
PAINSEC SECURITY RESEARCH GROUP SECURITY ADVISORY 2010-001
|
||
- Original release date: June 24th, 2010
|
||
- Discovered by: Jose Carlos de Arriba (dade (at) painsec (dot) com)
|
||
- Severity: 10/10 (Base CVSS Score)
|
||
============================================================
|
||
|
||
I. VULNERABILITY
|
||
————————-
|
||
ActiveCollab 2.3.0 Local File Inclusion / Directory Traversal (prior
|
||
version hasn’t been checked so are probably vulnerable).
|
||
|
||
II. BACKGROUND
|
||
————————-
|
||
ActiveCollab is a non-free project management & collaboration tool
|
||
that you can
|
||
set up on your own server or local network. Work with your team,
|
||
clients and contractors in an easy to use environment, while keeping
|
||
full control over your data.
|
||
|
||
III. DESCRIPTION
|
||
————————-
|
||
ActiveCollab presents a Local File Inclusion / Directory Traversal
|
||
vulnerability on its “module” parameter, due to an insufficient
|
||
sanitization on user supplied data.
|
||
|
||
A malicious user could get all the files in the web server, and also
|
||
get all a shell in the system, in case of being able to write PHP code
|
||
in any file that could be loaded through the “module” parameter
|
||
(i.e Apache logs).
|
||
|
||
IV. PROOF OF CONCEPT
|
||
————————-
|
||
http://www.victim.com/active/index.php?action=DetailView&module=/../../../../../../../etc/passwd%00<http://www.victim.com/active/index.php?action=DetailView&module=/../..>
|
||
|
||
V. BUSINESS IMPACT
|
||
————————-
|
||
An attacker could get all files in the server or gain complete access.
|
||
|
||
VI. SYSTEMS AFFECTED
|
||
————————-
|
||
ActiveCollab 2.3.0 (prior version hasn’t been checked so are probably
|
||
vulnerable).
|
||
|
||
VII. SOLUTION
|
||
————————-
|
||
Corrected
|
||
|
||
VIII. REFERENCES
|
||
————————-
|
||
http://www.activecollab.com
|
||
http://www.painsec.com
|
||
http://www.dadesecurity.com
|
||
|
||
IX. CREDITS
|
||
————————-
|
||
This vulnerability has been discovered
|
||
by Jose Carlos de Arriba (dade (at) painsec (dot) com).
|
||
|
||
X. REVISION HISTORY
|
||
————————-
|
||
June 24, 2010: Initial release.
|
||
|
||
XI. DISCLOSURE TIMELINE
|
||
————————-
|
||
June 9, 2010: Discovered by Jose Carlos de Arriba (Dade).
|
||
June 19, 2010: Vendor contacted including PoC. No response.
|
||
June 20, 2010: Response from ActiveCollab developer confirming
|
||
future fix.
|
||
June 24, 2010: Vulnerability fixed on 2.3.1 version release.
|
||
|
||
XII. LEGAL NOTICES
|
||
————————-
|
||
The information contained within this advisory is supplied “as-is”
|
||
with no warranties or guarantees of fitness of use or otherwise. |