Centrinity FirstClass HTTP Server Directory Disclosure Vulnerability
BID:8920
Info
Centrinity FirstClass HTTP Server Directory Disclosure Vulnerability
| Bugtraq ID: | 8920 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 28 2003 12:00AM |
| Updated: | Oct 28 2003 12:00AM |
| Credit: | The disclosure of this issue has been credited to Richard Maudsley <[email protected]>. |
| Vulnerable: |
Centrinity FirstClass 7.1 |
| Not Vulnerable: | |
Discussion
Centrinity FirstClass HTTP Server Directory Disclosure Vulnerability
It has been reported that Centrinity FirstClass HTTP server may be prone to an information disclosure vulnerability that may allow a remote attacker to disclose listings for server root and user web directories on a vulnerable system. This issue may be exploited by appending "/Search" to the URL of the server which directs the user to a file search form. The attacker may then be able to access information about the directories by selecting all options in the form and leaving the filename field blank.
** Conflicting reports have been submitted stating that universal access to server root and user web directories is granted by default in order to accommodate ease of use. No sensitive information is placed in these directories by default. If needed, users may protect private portions of the web site by employing FirstClass' ACL protected containers called conferences. It has also been reported that the search utility may be easily disabled by accessing "Unauthenticated Users" privilege group located in the "Groups" folder.
Successful exploitation of this issue result in disclosure of sensitive information which may be useful in further attacks against the system.
This problem has been reported to exist in FirstClass 7.1. It is possible that other versions are affected as well.
It has been reported that Centrinity FirstClass HTTP server may be prone to an information disclosure vulnerability that may allow a remote attacker to disclose listings for server root and user web directories on a vulnerable system. This issue may be exploited by appending "/Search" to the URL of the server which directs the user to a file search form. The attacker may then be able to access information about the directories by selecting all options in the form and leaving the filename field blank.
** Conflicting reports have been submitted stating that universal access to server root and user web directories is granted by default in order to accommodate ease of use. No sensitive information is placed in these directories by default. If needed, users may protect private portions of the web site by employing FirstClass' ACL protected containers called conferences. It has also been reported that the search utility may be easily disabled by accessing "Unauthenticated Users" privilege group located in the "Groups" folder.
Successful exploitation of this issue result in disclosure of sensitive information which may be useful in further attacks against the system.
This problem has been reported to exist in FirstClass 7.1. It is possible that other versions are affected as well.
Exploit / POC
Centrinity FirstClass HTTP Server Directory Disclosure Vulnerability
The following proof of concept has been provided:
http://www.example.com/Search
http://www.example.com/~Account%20Name/Search
The following proof of concept has been provided:
http://www.example.com/Search
http://www.example.com/~Account%20Name/Search
Solution / Fix
Centrinity FirstClass HTTP Server Directory Disclosure Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Centrinity FirstClass HTTP Server Directory Disclosure Vulnerability
References:
References:
- FirstClass Product Page (Centrinity)
- FirstClass 7.1 HTTP Server: Remote Directory Listing (Richard Maudsley