Folders Directory Traversal Vulnerability

Bugtraq ID:	46568
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 25 2011 12:00AM
Updated:	Feb 25 2011 12:00AM
Credit:	Khashayar Fereidani, Sina YazdanMehr, and Arash Allebrahim
Vulnerable:	Ractor Folders 2.5
Not Vulnerable:

Folders Directory Traversal Vulnerability

Folders is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue can allow an attacker to retrieve arbitrary files outside of the web server root directory. Information obtained may aid in further attacks.

Folders 2.5 is affected; other versions may also be vulnerable.

Folders Directory Traversal Vulnerability

Attackers can use readily available tools and commands to exploit this issue.

The following example URI is available:

http://www.example.com:8080//..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f/

Folders Directory Traversal Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Folders Directory Traversal Vulnerability

References:

• Folders Product Page (Ractor)
  
• iPhone Folders 2.5 Directory Traversal (Khashayar Fereidani - Sina YazdanMehr - Arash Allebrahim)