1C: Arcadia Internet Store Arbitrary File Disclosure Vulnerability

Bugtraq ID:	2902
Class:	Input Validation Error
CVE:	CVE-2001-0705
Remote:	Yes
Local:	No
Published:	Jun 21 2001 12:00AM
Updated:	Jul 11 2009 06:56AM
Credit:	This vulnerability was submitted to BugTraq on June 21st, 2001 by ViperSV <[email protected]> of NERF Security gr0up.
Vulnerable:	Arcadia 1C: Arcadia Internet Store 1.0
Not Vulnerable:

1C: Arcadia Internet Store Arbitrary File Disclosure Vulnerability

1C: Arcadia Internet Store is a online shopping utility for Microsoft Windows NT/2000 that is fully integratable with 1C: Enterprise, another popular Russian web-commerce utility.

One of the components of this package, 'tradecli.dll', allows users to specify a template file, the contents of which will be output. There is no filtering on '..\' character sequences. As a result, remote users can specify an arbitrary file on the same drive as the webserver by 'traversing' outside of the web root directory.

This vulnerability may disclose sensitive information to attackers.

1C: Arcadia Internet Store Arbitrary File Disclosure Vulnerability

This example was provided by NERF Security gr0up:

Exploit: http://host/script/tradecli.dll?template=..\..\..\..\..\path\to\file

1C: Arcadia Internet Store Arbitrary File Disclosure Vulnerability

Solution:
The vendor has released an update(which is available freely for registered users) addressing this and other issues.

More information is available to registered users at:

http://www.magazin.ru/mag97/release4/TradeCli.txt


Arcadia 1C: Arcadia Internet Store 1.0

• Arcadia TradeCli.dll
  http://www.magazin.ru/download_75.shtml

1C: Arcadia Internet Store Arbitrary File Disclosure Vulnerability

References:

• Arcadia Homepage (Arcadia)