exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

DevExpress ASP.NET File Manager 13.2.8 Directory Traversal

DevExpress ASP.NET File Manager 13.2.8 Directory Traversal
Posted Jun 5, 2014
Site redteam-pentesting.de

DevExpress ASP.NET File Manager versions 10.2 through 13.2.8 suffer from a directory traversal vulnerability.

tags | exploit, asp
advisories | CVE-2014-2575
SHA-256 | 394a34f5bb9c0db271438b8c89cbdc148df7951f648d6063157e850611f77962

DevExpress ASP.NET File Manager 13.2.8 Directory Traversal

Change Mirror Download
Advisory: Directory Traversal in DevExpress ASP.NET File Manager

During a penetration test RedTeam Pentesting discovered a directory
traversal vulnerability in DevExpress' ASP.NET File Manager and File
Upload. Attackers are able to read arbitrary files by specifying a
relative path.


Product: DevExpress ASPxFileManager Control for WebForms and MVC
Affected Versions: DevExpress ASPxFileManager v10.2 to v13.2.8
Fixed Versions: DevExpress ASPxFileManager v13.2.9
Vulnerability Type: Directory Traversal
Security Risk: high
Vendor URL:
Vendor Status: fixed version released
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2014-006
Advisory Status: published
CVE: CVE-2014-2575
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2575


"The DevExpress ASP.NET Subscription includes a standalone Multi-File
Upload Manager for WebForms and MVC and a pre-built File Manager for
WebForms; built so you can instantly introduce file management
capabilities in your next web application."

(from DevExpress' Homepage)

More Details

The ASPX File Manager component is prone to a directory traversal
vulnerability. Attackers with access to the File Manager component can
read arbitrary files on the same partition as the shared directory.

A common request to download a file via the File Manager component
requires multiple HTTP-Post parameters:


The parameter __EVENTARGUMENT=13|<file.ext> specifies a file download
and the file which is to be downloaded. Attackers may also request files
outside of the shared directory by prepending a relative path to a
parent directory.

Proof of Concept

By requesting files with a relative path, files otherwise not available
will be accessible through the File Manager component. Depending on the
shared directory and the webserver configuration, the webserver
configuration file might for example be accessible through the File
Manager component:


Other sensitive operating system files could be affected, too.

Example exploit:
curl --data __EVENTTARGET=ctl00%24ContentPlaceHolder1%24ASPxFileManager1\
"&__EVENTARGUMENT=13%7C../../web.config&=&__EVENTVALID" \

The request above will download the specified file.


Instead of a physical file system provider, a database file system
provider with limited access permissions could be used.


Update ASPxFileManager control to DevExpress libraries version v13.2.9.

Security Risk

The risk is estimated to be high. This vulnerability allows attackers to
access arbitrary files on the same partition as the File Manager's root
directory. This may allow attackers to read sensitive information like
the webserver configuration.


2014-03-10 Vulnerability identified
2014-03-21 Customer approved disclosure to vendor
2014-03-21 CVE number requested and assigned
2014-03-25 Vendor notified
2014-04-11 Customer opened support ticket with vendor
2014-04-17 Vendor released fixed version
2014-04-17 Vendor released security advisory to customers
2014-06-05 Advisory released


Vendor Security Advisory:

RedTeam Pentesting GmbH

RedTeam Pentesting offers individual penetration tests, short pentests,
performed by a team of specialised IT-security experts. Hereby, security
weaknesses in company networks or products are uncovered and can be
fixed immediately.

As there are only few experts in this field, RedTeam Pentesting wants to
share its knowledge and enhance the public knowledge with research in
security related areas. The results are made available as public
security advisories.

More information about RedTeam Pentesting can be found at

RedTeam Pentesting GmbH Tel.: +49 241 510081-0
Dennewartstr. 25-27 Fax : +49 241 510081-99
52068 Aachen https://www.redteam-pentesting.de
Germany Registergericht: Aachen HRB 14004
Geschäftsführer: Patrick Hof, Jens Liebchen
Login or Register to add favorites

File Archive:

June 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    18 Files
  • 2
    Jun 2nd
    13 Files
  • 3
    Jun 3rd
    0 Files
  • 4
    Jun 4th
    0 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    0 Files
  • 7
    Jun 7th
    0 Files
  • 8
    Jun 8th
    0 Files
  • 9
    Jun 9th
    0 Files
  • 10
    Jun 10th
    0 Files
  • 11
    Jun 11th
    0 Files
  • 12
    Jun 12th
    0 Files
  • 13
    Jun 13th
    0 Files
  • 14
    Jun 14th
    0 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    0 Files
  • 20
    Jun 20th
    0 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Security Services
Hosting By