SmarterMail 7.1.3876 directory traversal vulnerability

2010-09-22 / 2012-08-07
Credit: sqlhacker
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-22


Ogólna skala CVSS: 5/10
Znaczenie: 2.9/10
Łatwość wykorzystania: 10/10
Wymagany dostęp: Zdalny
Złożoność ataku: Niska
Autoryzacja: Nie wymagana
Wpływ na poufność: Częściowy
Wpływ na integralność: Brak
Wpływ na dostępność: Brak

Vendor: smartertools.com SmarterMail 7.x (7.1.3876) | Bug : Directory Traversal, OS Command Injection, Other Critcal Vulns ######################################################################## # Vendor: smartertools.com SmarterMail 7.x (7.1.3876) # Date: 2010-09-12 # Author : sqlhacker ? http://cloudscan.me # Thanks to : Burp Suite Pro - engagement tool # : FuzzDB # Contact : h02332@gmail.com # Home : http://cloudscan.me # Dork : insite: SmarterMail Enterprise 7.1 # Bug : Directory Traversal, OS Command Injection, Other Critcal Vulns # Tested on : SmarterMail 7.x (7.1.3876) // Windows 2008 /64/R2 # Vendor Contact - August 14, 2010 # -Multiple email exchanges with Vendor thru Labor Day 2010 # - Vendor took no action 9/1/2010 # - Public Disclosure with Workaround Solution Provided 9-4-2010 ######################################################################## Source URL http://cloudscan.blogspot.com/2010/09/smarter-stats-533819-file-fuzzing.html The default installation of SmarterMail is vulnerable to 1 (or more) of the file fuzzing types contained within FuzzDB and Burp Suite Pro 1.3.08 as a baseline analysis for exploit surface modeling. Reduced to exploits, Directory Traversal, OS Injection and Execution. Initial Exploit Requires user-level privs. A malicious user seeking to exploit Browser Clients can launch attacks from the User Home / Public Web Directory utilizing the SSL Certificate of the Host Provider. A malicious user seeking to exploit the Host Server can launch attacks as Local File Inclusion or Remote File Inclusion and perform Operating System Injections and Execution. A malicious user can read and write directories, files and perform malicious operations due to the default configuration of smartermail. This is reduced to: GET {Vulnerable SmarterMail Site}/path/*payload*relative/path/to/target/file/ ..%255c .%5c../..%5c /..%c0%9v../ /..%c0%af../ /..%255c..%255c ../../../../../../win.ini ../../../../../../SmarterMail/ExploitShells ../../../../../../SmarterMail/{Domain}/{(l)uzername)/PubPayloadDir/logo_25.jpg%../%../somewhere to read/write A workaround is posted in the Source URL http://cloudscan.blogspot.com/2010/09/smarter-stats-533819-file-fuzzing.html


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top