ActiveCollab 2.3.0 local file inclusion and directory traversal

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1050575 漏洞类型
发布时间 2010-06-26 更新时间 2010-06-26
CVE编号 N/A CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2010060107
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
============================================================
PAINSEC SECURITY RESEARCH GROUP SECURITY ADVISORY 2010-001
- Original release date: June 24th, 2010
- Discovered by: Jose Carlos de Arriba (dade (at) painsec (dot) com)
- Severity: 10/10 (Base CVSS Score)
============================================================

I. VULNERABILITY
-------------------------
ActiveCollab 2.3.0 Local File Inclusion / Directory Traversal (prior
version hasn't been checked so are probably vulnerable).

II. BACKGROUND
-------------------------
ActiveCollab is a non-free project management & collaboration tool
that you can
set up on your own server or local network. Work with your team,
clients and contractors in an easy to use environment, while keeping
full control over your data.

III. DESCRIPTION
-------------------------
ActiveCollab presents a Local File Inclusion / Directory Traversal
vulnerability on its "module" parameter, due to an insufficient
sanitization on user supplied data.

A malicious user could get all the files in the web server, and also
get all a shell in the system, in case of being able to write PHP code
in any file that could be loaded through the "module" parameter
(i.e Apache logs).

IV. PROOF OF CONCEPT
-------------------------
http://www.victim.com/active/index.php?action=DetailView&module=/../....

V. BUSINESS IMPACT
-------------------------
An attacker could get all files in the server or gain complete access.

VI. SYSTEMS AFFECTED
-------------------------
ActiveCollab 2.3.0 (prior version hasn't been checked so are probably
vulnerable).

VII. SOLUTION
-------------------------
Corrected

VIII. REFERENCES
-------------------------
http://www.activecollab.com
http://www.painsec.com
http://www.dadesecurity.com

IX. CREDITS
-------------------------
This vulnerability has been discovered
by Jose Carlos de Arriba (dade (at) painsec (dot) com).

X. REVISION HISTORY
-------------------------
June    24, 2010: Initial release.

XI. DISCLOSURE TIMELINE
-------------------------
June    9, 2010: Discovered by Jose Carlos de Arriba (Dade).
June   19, 2010: Vendor contacted including PoC. No response.
June   20, 2010: Response from ActiveCollab developer confirming
future fix.
June   24, 2010: Vulnerability fixed on 2.3.1 version release.

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is"
with no warranties or guarantees of fitness of use or otherwise.