OXID eShop Path Traversal Vulnerability

2016.05.05
Credit: LSE
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-22

OXID eShop Path Traversal Vulnerability ------------------------------------------------------------------------ Affected Versions ================= Community Edition 4.9.7 Issue Overview ============== Vulnerability Type: path traversal, privilege escalation Version: Tested in Community Edition 4.9.7 Technical Risk: high Likelihood of Exploitation: medium Vendor: OXID eSales AG Vendor URL: https://www.oxid-esales.com Credits: LSE Leading Security Experts GmbH employee Tim Herres Advisory URL: https://www.lsexperts.de/advisories/lse-2016-02-03.txt Advisory Status: Public CVE-Number: NA CVE URL: NA OVE-ID:OVE-20160419-0002 OVI-ID:OVI-2016-7988 CWE-ID: CWE-22 CVSS 2.0: 3.5 (AV:N/AC:M/Au:S/C:P/I:N/A:N) Impact ====== A missing file path validation allows an authenticated user with permission to add or edit products to read any file on the file system without permissions. Issue Description ================= While conducting an internal evaluation of the software, LSE Leading Security Experts GmbH discovered a path traversal vulnerability in the product downloads function. A user with permissions to change or add products may change the Downloads name to a local file (e.g. "../../../config.inc.php"). This may lead to a privilege escalation. Temporary Workaround and Fix ============================ Install latest update 4.9.8/5.2.8 See http://wiki.oxidforge.org/Downloads/4.9.8_5.2.8 Proof of Concept ================ Create a new product in the backend. In the "Downloads" tab set "name of the uploaded file" to "../../../config.inc.php". Go to the frontend and buy the related product. Move to "My account" and choose the download section. Download the file and enjoy full database credentials. History ======= 2016-02-05 Issue discovered 2016-02-22 Vendor contacted 2016-02-24 Vendor confirmed 2016-05-03 Vendor released patch 2016-05-03 Advisory release GPG Signature ============= This advisory is signed with the GPG key of the LSE Leading Security Experts GmbH advisories team. The key can be downloaded here: https://www.lsexperts.de/advisories-key-99E3277C.asc


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top