HFS HTTP File Server Arbitrary File Upload Vulnerability

Bugtraq ID:	26732
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 05 2007 12:00AM
Updated:	Dec 08 2007 02:42AM
Credit:	Luigi Auriemma is credited with the discovery of this vulnerability.
Vulnerable:	HTTP File Server HTTP File Server 2.3 beta HTTP File Server HTTP File Server 2.2a HTTP File Server HTTP File Server 2.2
Not Vulnerable:	HTTP File Server HTTP File Server 2.2b

HFS HTTP File Server Arbitrary File Upload Vulnerability

HFS HTTP File Server is prone to a vulnerability that lets attackers upload files and place them in arbitrary locations on the server. The issue occurs because the software fails to adequately sanitize user-supplied input.

A successful exploit may allow the attacker to upload malicious files and potentially execute them; this may lead to various attacks.

This issue affects versions prior to HTTP File Server 2.2b.

HFS HTTP File Server Arbitrary File Upload Vulnerability

Attackers may exploit this issue through a client application.

Proof-of-concept examples are available:

http://SERVER/folder file.txt ../../../file.txt

• /data/vulnerabilities/exploits/myhttpup.zip

HFS HTTP File Server Arbitrary File Upload Vulnerability

Solution:
The vendor released HTTP File Server 2.2b to address this issue. Please see the references for more information.


HTTP File Server HTTP File Server 2.2a

• HTTP File Server HTTP File Server 2.2b
  http://www.rejetto.com/hfs/?f=dl

HTTP File Server HTTP File Server 2.2

• HTTP File Server HTTP File Server 2.2b
  http://www.rejetto.com/hfs/?f=dl

HFS HTTP File Server Arbitrary File Upload Vulnerability

References:

• HFS Home Page (Http File Server)
  
• HTTP File Server (Luigi Auriemma)
  
• Limited upload directory traversal in HTTP File Server 2.2a / 2.3 beta (build #1 (Luigi Auriemma )