Directory Pro Arbitrary File Disclosure Vulnerability
BID:2793
Info
Directory Pro Arbitrary File Disclosure Vulnerability
| Bugtraq ID: | 2793 |
| Class: | Input Validation Error |
| CVE: |
CVE-2001-0780 |
| Remote: | Yes |
| Local: | No |
| Published: | May 28 2001 12:00AM |
| Updated: | Jul 11 2009 06:06AM |
| Credit: | Discovered by Marshal <[email protected]> and published on May 28, 2001. |
| Vulnerable: |
Cosmicperl Directory Pro 2.0 |
| Not Vulnerable: | |
Discussion
Directory Pro Arbitrary File Disclosure Vulnerability
Webdirectory Pro is a web application used to create a searchable directory of links developed by Cosmicperl.
Webdirectory Pro contains an input validation vulnerability which may lead to disclosure of sensitive information to attackers. The value of the 'show' variable is not properly validated and can be used to force 'directorypro.cgi' to output the contents of an arbitrary webserver-readable file to a remote attacker.
This is due to a lack of checks for NULL bytes in user-supplied data.
Webdirectory Pro is a web application used to create a searchable directory of links developed by Cosmicperl.
Webdirectory Pro contains an input validation vulnerability which may lead to disclosure of sensitive information to attackers. The value of the 'show' variable is not properly validated and can be used to force 'directorypro.cgi' to output the contents of an arbitrary webserver-readable file to a remote attacker.
This is due to a lack of checks for NULL bytes in user-supplied data.
Exploit / POC
Directory Pro Arbitrary File Disclosure Vulnerability
Submit a request such as this to a vulnerable webserver:
http://target/cgi-bin/directorypro.cgi?want=showcat&show=../../../..//etc/motd%00
This will result in the contents of '/etc/motd' being output.
Submit a request such as this to a vulnerable webserver:
http://target/cgi-bin/directorypro.cgi?want=showcat&show=../../../..//etc/motd%00
This will result in the contents of '/etc/motd' being output.
Solution / Fix
Directory Pro Arbitrary File Disclosure Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.