iFile Directory Traversal Vulnerability

Bugtraq ID:	46569
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 25 2011 12:00AM
Updated:	Feb 25 2011 12:00AM
Credit:	Khashayar Fereidani, Sina YazdanMehr, and Arash Allebrahim
Vulnerable:	SG Game iFile 2.0
Not Vulnerable:

iFile Directory Traversal Vulnerability

iFile is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue can allow an attacker to retrieve arbitrary files outside of the web server root directory. Information obtained may aid in further attacks.

iFile 2.0 is affected; other versions may also be vulnerable.

iFile Directory Traversal Vulnerability

Attackers can use readily available tools and commands to exploit this issue.

The following example URI is available:

http://www.example.com:8080//..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f/

iFile Directory Traversal Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

iFile Directory Traversal Vulnerability

References:

• iFile Product Page (SG Game)
  
• iPhone iFile 2.0 Directory Traversal (Khashayar Fereidani - Sina YazdanMehr - Arash Allebrahim)