A10 Networks Loadbalancer Directory Traversal

2014.01.29
Credit: xistence
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-22

----------- Author: ----------- xistence < xistence[at]0x90[.]nl > ------------------------- Affected products: ------------------------- A10 Networks Loadbalancer (Soft)AX <=2.6.1-GR1-P5 & <=2.7.0 build 217 ------------------------- Affected vendors: ------------------------- A10Networks http://www.a10networks.com/ ------------------------- Product description: ------------------------- SupportCenter Plus is a web-based customer support software that lets organizations effectively manage customer tickets, their account & contact information, the service contracts and in the process providing a superior customer experience. ---------- Details: ---------- [ 0x01 - Directory Traversal ] A10 Networks (Soft)AX <=2.6.1-GR1-P5 & <=2.7.0 build 217 is prone to an unauthenticated directory traversal vulnerability. It's possible to download any file on the remote AX device with root privileges, without the need to authenticate to the website. The bug was fixed earlier in A10 Tracking ID "82150" according to the release notes, however the fix is not sufficient and can be bypassed. The new protection seems to make sure files are under the /a10data/tmp dir (https://<IP>/xml/downloads/?filename=/a10data/tmp/). By sending a GET request to "https://<IP>/xml/downloads/?filename=/a10data/tmp/../.." and thus keeping /a10data/tmp, we can bypass this. So if we would like to download the file /etc/shadow we send a GET request to "https:// <IP>/xml/downloads/?filename=/a10data/tmp/../../etc/passwd". Or if we would like to download a certificate key file: "https:// <IP>/xml/downloads/?filename=/a10data/tmp/../../a10data/key/domain.com" WARNING: Downloading a file will delete it from the AX device! ----------- Solution: ----------- Upgrade to a newer version. -------------- Timeline: -------------- Fixed somewhere back in 2013 :)

References:

http://www.a10networks.com/


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top