Vendor: smartertools.com SmarterMail 7.x (7.1.3876) | Bug : Directory Traversal, OS Command Injection, Other Critcal Vulns ######################################################################## # Vendor: smartertools.com SmarterMail 7.x (7.1.3876) # Date: 2010-09-12 # Author : sqlhacker ? http://cloudscan.me # Thanks to : Burp Suite Pro - engagement tool # : FuzzDB # Contact : h02332@gmail.com # Home : http://cloudscan.me # Dork : insite: SmarterMail Enterprise 7.1 # Bug : Directory Traversal, OS Command Injection, Other Critcal Vulns # Tested on : SmarterMail 7.x (7.1.3876) // Windows 2008 /64/R2 # Vendor Contact - August 14, 2010 # -Multiple email exchanges with Vendor thru Labor Day 2010 # - Vendor took no action 9/1/2010 # - Public Disclosure with Workaround Solution Provided 9-4-2010 ######################################################################## Source URL http://cloudscan.blogspot.com/2010/09/smarter-stats-533819-file-fuzzing.html The default installation of SmarterMail is vulnerable to 1 (or more) of the file fuzzing types contained within FuzzDB and Burp Suite Pro 1.3.08 as a baseline analysis for exploit surface modeling. Reduced to exploits, Directory Traversal, OS Injection and Execution. Initial Exploit Requires user-level privs. A malicious user seeking to exploit Browser Clients can launch attacks from the User Home / Public Web Directory utilizing the SSL Certificate of the Host Provider. A malicious user seeking to exploit the Host Server can launch attacks as Local File Inclusion or Remote File Inclusion and perform Operating System Injections and Execution. A malicious user can read and write directories, files and perform malicious operations due to the default configuration of smartermail. This is reduced to: GET {Vulnerable SmarterMail Site}/path/*payload*relative/path/to/target/file/ ..%255c .%5c../..%5c /..%c0%9v../ /..%c0%af../ /..%255c..%255c ../../../../../../win.ini ../../../../../../SmarterMail/ExploitShells ../../../../../../SmarterMail/{Domain}/{(l)uzername)/PubPayloadDir/logo_25.jpg%../%../somewhere to read/write A workaround is posted in the Source URL http://cloudscan.blogspot.com/2010/09/smarter-stats-533819-file-fuzzing.html