Sitecore.NET 8.1 Directory Traversal

2018.04.27
Credit: Chris Moberly
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-22


CVSS Base Score: 7.8/10
Impact Subscore: 6.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Complete
Integrity impact: None
Availability impact: None

Sitecore Directory Traversal Vulnerability CVE-2018-7669 (reserved) An issue was discovered in Sitecore CMS that affects at least 'Sitecore.NET 8.1' rev. 151207 Hotfix 141178-1 and above. The 'Log Viewer' application is vulnerable to a directory traversal attack, allowing an attacker to access arbitrary files from the host Operating System using a 'sitecore/shell/default.aspx?xmlcontrol=LogViewerDetails&file=' URI. Validation is performed to ensure that the text passed to the 'file' parameter correlates to the correct log file directory. This filter can be bypassed by including a valid log filename and then appending a traditional 'dot dot' style attack. [Steps to Reproduce] The 'Log Viewer' application renders log files from the local filesystem inside the web browser using a URL like the following: http://<website>/sitecore/shell/default.aspx?xmlcontrol=LogViewerDetails&file= The following URL can be used to validate the vulnerability by accessing the win.ini file on a Windows host (remove line breaks): http://<website>/sitecore/shell/default.aspx?xmlcontrol=LogViewerDetails&file= c%3a%5cwebsites%5c<website>%5cdata%5clogs%5<valid log file>.txt\ ..\..\..\..\..\windows\win.ini The following URL can be used to access the application's configuration file containing SQL login credentials (remove line breaks): http://<website>/sitecore/shell/default.aspx?xmlcontrol=LogViewerDetails&file= c%3a%5cwebsites%5c<website>%5cdata%5clogs%5c<valid log file>.txt\ ..\..\..\Website\App_Config\ConnectionStrings.config Both of the above URLs are dependent on the application's configuration and must be modified to correct the <website> and <valid log file> portion. [Additional Information] Vendor confirmed receipt of the vulnerability and stated a fix was in progress. Vendor acknowledgement: https://kb.sitecore.net/articles/356221 ------------------------------------------ [Vulnerability Type] Directory Traversal ------------------------------------------ [Vendor of Product] Sitecore ------------------------------------------ [Affected Product Code Base] CMS - 8.1 and up (earlier versions untested) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Has vendor confirmed or acknowledged the vulnerability?] true ------------------------------------------ [Discoverer] Chris Moberly @ The Missing Link Security


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top