Advisory ID: HTB23147
Product: AWS XMS
Vendor: http://www.aws-dms.com
Vulnerable Version(s): 2.5 and probably prior
Tested Version: 2.5
Vendor Notification: March 6, 2013=20
Vendor Patch: March 16, 2013=20
Public Disclosure: March 27, 2013=20
Vulnerability Type: Path Traversal [CWE-22]
CVE Reference: CVE-2013-2474
Risk Level: Medium=20
CVSSv2 Base Score: 5 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://w=
ww.htbridge.com/advisory/ )=20
---------------------------------------------------------------------------=
--------------------
Advisory Details:
High-Tech Bridge Security Research Lab discovered path traversal vulnerabil=
ity in AWS XMS, which can be exploited to read contents of arbitrary files=
=2E
1) Path Traversal in AWS XMS: CVE-2013-2474
The vulnerability exists due to insufficient filtration of "what" HTTP GET =
parameter passed to "/importer.php" script before using it in PHP "file()" =
function. A remote attacker can read contents of arbitrary files on the tar=
get system.
The vulnerable script sets "text/javascript" Content-Type for the output da=
ta, which makes exploitation of the vulnerability via a web browser inconve=
nient. Exploitation via telnet or wget utilities is easier.=20
The following PoC (Proof of Concept) code uses wget utility to download sou=
rce code of "/default.php" file, which contains application configuration d=
ata and administrator=E2=80=99s credentials:
wget http://[host]/importer.php?what=3Ddefaults.php%00.js
To bypass protections against NULL-byte injection (implemented in PHP 5.3=
=2E4 and later versions) or enabled "magic_quotes_gpc", alternative techniq=
ues based on path normalization and length restrictions can be used.
The second PoC code uses a large amount of '/' symbols (4096 is sufficient =
for the majority of platforms) to bypass the restrictions and get source co=
de of the "/default.php" file:
wget http://[host]/importer.php?what=3Ddefaults.php///////...//////.js
---------------------------------------------------------------------------=
--------------------
Solution:
Upgrade to AWS XMS 2.6
More Information:
http://www.aws-dms.com/temp.php?use=3Dtemplates/download.xml#xms-2.6
---------------------------------------------------------------------------=
--------------------
References:
[1] High-Tech Bridge Advisory HTB23147 - https://www.htbridge.com/advisory/=
HTB23147 - Path Traversal in AWS XMS.
[2] AWS XMS - http://www.aws-dms.com/ - XMS is an online visual web develop=
ment enviroment and framework, providing a web application base, with multi=
language support, based on XML.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - in=
ternational in scope and free for public use, CVE=C2=AE is a dictionary of =
publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to =
developers and security practitioners, CWE is a formal list of software wea=
kness types.=20
---------------------------------------------------------------------------=
--------------------
Disclaimer: The information provided in this Advisory is provided "as is" a=
nd without any warranty of any kind. Details of this Advisory may be update=
d in order to provide as accurate information as possible. The latest versi=
on of the Advisory is available on web page [1] in the References.