BitKinex FTP LIST and WebDAV PROPFIND Commands Multiple Directory Traversal Vulnerabilities
BID:29545
Info
BitKinex FTP LIST and WebDAV PROPFIND Commands Multiple Directory Traversal Vulnerabilities
| Bugtraq ID: | 29545 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 04 2008 12:00AM |
| Updated: | Jun 04 2008 12:00AM |
| Credit: | Tan Chew Keong |
| Vulnerable: |
Barad-Dur BitKinex 2.9.3 |
| Not Vulnerable: | |
Discussion
BitKinex FTP LIST and WebDAV PROPFIND Commands Multiple Directory Traversal Vulnerabilities
BitKinex is prone to multiple directory-traversal vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
Exploiting these issues will allow an attacker to write arbitrary files to locations outside of the application's current directory. This could help the attacker launch further attacks.
BitKinex 2.9.3 is vulnerable; other versions may also be affected.
BitKinex is prone to multiple directory-traversal vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
Exploiting these issues will allow an attacker to write arbitrary files to locations outside of the application's current directory. This could help the attacker launch further attacks.
BitKinex 2.9.3 is vulnerable; other versions may also be affected.
Exploit / POC
BitKinex FTP LIST and WebDAV PROPFIND Commands Multiple Directory Traversal Vulnerabilities
An attacker can exploit these issues by enticing an unsuspecting victim to connect to a malicious server.
An attacker can exploit these issues by enticing an unsuspecting victim to connect to a malicious server.
Solution / Fix
BitKinex FTP LIST and WebDAV PROPFIND Commands Multiple Directory Traversal Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
BitKinex FTP LIST and WebDAV PROPFIND Commands Multiple Directory Traversal Vulnerabilities
References:
References:
- BitKinex Homepage (Barad-Dur)
- BitKinex WebDAV and FTP Clients Directory Traversal Vulnerability (vuln.sg)