SIG^2 Vulnerability Research Advisory

DeskNow Mail and Collaboration Server Directory Traversal Vulnerabilities

by Tan Chew Keong
Release Date: 02 Feb 2005


ADVISORY URL
http://www.security.org.sg/vuln/desknow2512.html


SUMMARY

DeskNow Mail and Collaboration Server (http://www.desknow.com/desknowmc/index.html) is a full-featured and integrated mail and instant messaging server, with webmail, secure instant messaging, document repository, shared calendars, address books, message boards, web-publishing, anti-spam features, Palm and PocketPC access and much more.

A directory traversal vulnerability was found in DeskNow webmail file attachment upload feature that may be exploited to upload files to arbitrary locations on the server. A malicious webmail user may upload a JSP file to the script directory of the server, and executing it by requesting the URL of the upload JSP file. A second directory traversal vulnerability exists in the document repository file delete feature. This vulnerability may be exploited to delete arbitrary files on the server. 
 

TESTED SYSTEM

DeskNow Mail and Collaboration Server Version 2.5.12 on English Win2K SP4


DETAILS

On the Windows platform, the default installation of DeskNow Mail and Collaboration Server runs its webmail service using Tomcat Application Server with LOCAL SYSTEM privilege. This advisory documents two directory traversal vulnerabilities that may be exploited by a malicious webmail user to upload/delete files to/from arbitrary directories.

 
1. Insufficient input sanitization in attachment.do allows file upload to arbitrary directories. 

DeskNow's webmail allows a logon mail user to upload file attachments when composing an email. Lack of sanitization of the AttachmentsKey parameter allows the user to upload files to arbitrary location on the server.  More specifically, It is possible to use directory traversal characters to cause the uploaded file attachment to be saved outside the temporary directory. This may be exploited by a malicious webmail user to upload JSP files to the script execution directory of the server. After uploading the JSP file, it is possible to execute that file by directly requesting it's URL (i.e. http://[hostname]/desknow/jsp/test/poc.jsp). Successful exploitation will allow upload and execution of arbitrary JSP code with LOCAL SYSTEM privilege. E.g. a malicious user may upload a JSP file that gives him/her a reverse shell.


2. Insufficient input sanitization in file.do allows deleting of arbitrary files.

DeskNow's document repository feature allows a user to store files on the server via the web interface. A user is allowed to delete his/her own files. When the user selects his own file to be deleted, the file name is sent using the select_file parameter as a POST request to file.do. It is possible to use directory traversal characters within this parameter to delete files that do not belong to the user. 


PATCH

Upgrade to DeskNow Mail and Collaboration Server Version 2.5.14 or later.

 
DISCLOSURE TIMELINE

23 Jan 05 - Vulnerability Discovered.
24 Jan 05 - Initial Vendor Notification.
24 Jan 05 - Initial Vendor Reply.
25 Jan 05 - Vendor Released Version 2.5.13.
25 Jan 05 - Informed Vendor that Vulnerability is not Fully Fixed.
27 Jan 05 - Vendor Released Fixed Version 2.5.14.
02 Feb 05 - Public Release


GREETINGS

All guys at SIG^2 G-TEC Lab
http://www.security.org.sg/webdocs/g-tec.html 

"IT Security...the Gathering. By enthusiasts for enthusiasts."