Interactive Story Directory Traversal Vulnerability

Bugtraq ID:	3028
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 15 2001 12:00AM
Updated:	Jul 15 2001 12:00AM
Credit:	This vulnerability was submitted to BugTraq on July 15th, 2001 by qDefense Advisories <[email protected]>.
Vulnerable:	Valerie Mates Interactive Story 1.3
Not Vulnerable:	Valerie Mates Interactive Story 1.4

Interactive Story Directory Traversal Vulnerability

Interactive Story is a web-based application written in Perl and is distributed as freeware.

Interactive Story does not filter '../' sequences from user input submitted to a hidden file called 'next'. Remote attackers may take advantage of this by crafting URLs that allow them to break out of webroot and view arbitrary web-readable files.

The disclosed information may be used in further attacks on the host.

Interactive Story Directory Traversal Vulnerability

This example was included in the BugTraq posting by qDefense Advisories <[email protected]>:

If an attacker sets the "next" field to something like
../../../../../../../../../../etc/passwd%00, Interactive Story will open and display the password file.

Interactive Story Directory Traversal Vulnerability

Solution:
The vendor has released an update which address this issue.

Interactive Story Directory Traversal Vulnerability

References:

• Interactive Story Author Page (Valerie Mates)