Technote Inc Technote 'board' Function File Disclosure Vulnerability
BID:2155
Info
Technote Inc Technote 'board' Function File Disclosure Vulnerability
| Bugtraq ID: | 2155 |
| Class: | Input Validation Error |
| CVE: |
CVE-2001-0074 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Dec 23 2000 12:00AM |
| Updated: | Jul 11 2009 04:46AM |
| Credit: | Discoverd and posted to Bugtraq by <[email protected]> on Dec 23, 2000. |
| Vulnerable: |
Technote Technote Pro Technote Technote 2001 Technote Technote 2000 |
| Not Vulnerable: | |
Discussion
Technote Inc Technote 'board' Function File Disclosure Vulnerability
Technote Inc. offers a Multicommunication Package which includes a web board type of service.
A script that ships with Technote, print.cgi, accepts a parameter called "board". This remotely-supplied variable is used as a filename when the open() function is called. In addition to allowing the attacker to specify a file to be opened remotely, the variable is not checked for "../" character sequences. As a result, a malicious remote user can specify an arbitrary file on the file system as this variable (by using ../ sequences followed by its real path), which will be opened by the script. Its contents will then be disclosed to the attacker.
Successful exploitation of this vulnerability could lead to the disclosure of sensitive information and possibly assist in further attacks against the victim
It should be noted that the attacker may only read files which are accessible to the web-server process.
Technote Inc. offers a Multicommunication Package which includes a web board type of service.
A script that ships with Technote, print.cgi, accepts a parameter called "board". This remotely-supplied variable is used as a filename when the open() function is called. In addition to allowing the attacker to specify a file to be opened remotely, the variable is not checked for "../" character sequences. As a result, a malicious remote user can specify an arbitrary file on the file system as this variable (by using ../ sequences followed by its real path), which will be opened by the script. Its contents will then be disclosed to the attacker.
Successful exploitation of this vulnerability could lead to the disclosure of sensitive information and possibly assist in further attacks against the victim
It should be noted that the attacker may only read files which are accessible to the web-server process.
Exploit / POC
Technote Inc Technote 'board' Function File Disclosure Vulnerability
The following example is provided by <[email protected]>:
http://target/technote/technote/print.cgi?board=../../../../../../../../etc/passwd%00
The following example is provided by <[email protected]>:
http://target/technote/technote/print.cgi?board=../../../../../../../../etc/passwd%00
References
Technote Inc Technote 'board' Function File Disclosure Vulnerability
References:
References:
- Technote Homepage (Technote Inc.)