[SIG^2 G-TEC] DeskNow Mail and Collaboration Server Directory Traversal Vulnerabilities

[<chewkeong@xxxxxxxxxxxxxxx>]

SIG^2 Vulnerability Research Advisory

DeskNow Mail and Collaboration Server Directory Traversal Vulnerabilities

by Tan Chew Keong
Release Date: 02 Feb 2005


ADVISORY URL
http://www.security.org.sg/vuln/desknow2512.html


SUMMARY

DeskNow Mail and Collaboration Server 
(http://www.desknow.com/desknowmc/index.html) is a full-featured and integrated 
mail and instant messaging server, with webmail, secure instant messaging, 
document repository, shared calendars, address books, message boards, 
web-publishing, anti-spam features, Palm and PocketPC access and much more.

A directory traversal vulnerability was found in DeskNow webmail file 
attachment upload feature that may be exploited to upload files to arbitrary 
locations on the server. A malicious webmail user may upload a JSP file to the 
script directory of the server, and executing it by requesting the URL of the 
upload JSP file. A second directory traversal vulnerability exists in the 
document repository file delete feature. This vulnerability may be exploited to 
delete arbitrary files on the server. 
 

TESTED SYSTEM

DeskNow Mail and Collaboration Server Version 2.5.12 on English Win2K SP4


DETAILS

On the Windows platform, the default installation of DeskNow Mail and 
Collaboration Server runs its webmail service using Tomcat Application Server 
with LOCAL SYSTEM privilege. This advisory documents two directory traversal 
vulnerabilities that may be exploited by a malicious webmail user to 
upload/delete files to/from arbitrary directories.

 
1. Insufficient input sanitization in attachment.do allows file upload to 
arbitrary directories. 

DeskNow's webmail allows a logon mail user to upload file attachments when 
composing an email. Lack of sanitization of the AttachmentsKey parameter allows 
the user to upload files to arbitrary location on the server.  More 
specifically, It is possible to use directory traversal characters to cause the 
uploaded file attachment to be saved outside the temporary directory. This may 
be exploited by a malicious webmail user to upload JSP files to the script 
execution directory of the server. After uploading the JSP file, it is possible 
to execute that file by directly requesting it's URL (i.e. 
http://[hostname]/desknow/jsp/test/poc.jsp). Successful exploitation will allow 
upload and execution of arbitrary JSP code with LOCAL SYSTEM privilege. E.g. a 
malicious user may upload a JSP file that gives him/her a reverse shell.


2. Insufficient input sanitization in file.do allows deleting of arbitrary 
files.

DeskNow's document repository feature allows a user to store files on the 
server via the web interface. A user is allowed to delete his/her own files. 
When the user selects his own file to be deleted, the file name is sent using 
the select_file parameter as a POST request to file.do. It is possible to use 
directory traversal characters within this parameter to delete files that do 
not belong to the user. 


PATCH

Upgrade to DeskNow Mail and Collaboration Server Version 2.5.14 or later.

 
DISCLOSURE TIMELINE

23 Jan 05 - Vulnerability Discovered.
24 Jan 05 - Initial Vendor Notification.
24 Jan 05 - Initial Vendor Reply.
25 Jan 05 - Vendor Released Version 2.5.13.
25 Jan 05 - Informed Vendor that Vulnerability is not Fully Fixed.
27 Jan 05 - Vendor Released Fixed Version 2.5.14.
02 Feb 05 - Public Release


GREETINGS

All guys at SIG^2 G-TEC Lab
http://www.security.org.sg/webdocs/g-tec.html 

"IT Security...the Gathering. By enthusiasts for enthusiasts."