----------------------------------------------------------------------

A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI
has been released. The new version includes many new and advanced
features, which makes it even easier to stay patched.

Download and test it today:
https://psi.secunia.com/

Read more about this new version:
https://psi.secunia.com/?page=changelog

----------------------------------------------------------------------

TITLE:
Elastic Path Multiple Directory Traversal Vulnerabilities

SECUNIA ADVISORY ID:
SA29496

VERIFY ADVISORY:
http://secunia.com/advisories/29496/

CRITICAL:
Moderately critical

IMPACT:
Security Bypass, Exposure of system information, Exposure of
sensitive information, System access

WHERE:
>From remote

SOFTWARE:
Elastic Path 4.x
http://secunia.com/product/18069/

DESCRIPTION:
Daniel Martin Gomez has reported some vulnerabilities in Elastic
Path, which can be exploited by malicious users to disclose sensitive
information or to potentially compromise a vulnerable system.

1) Input passed to the "file" parameter in
manager/getImportFileRedirect.jsp is not properly sanitised before
being used to download files. This can be exploited to download
arbitrary files via directory traversal attacks. 

2) Input passed via the file name when uploading files in
importData.jsp is not properly sanitised before being used to upload
files. This can be exploited to upload files to arbitrary directories
via directory traversal attacks.    

3) Input passed to the "dir" parameter in manager/fileManager.jsp is
not properly sanitised before being used to list files. This can be
exploited to list the content of arbitrary directories via directory
traversal attacks.

Successful exploitation of the vulnerabilities requires that the user
has download and upload privileges.

The vulnerabilities are reported in versions 4.1 and 4.1.1. Prior
versions may also be affected.

SOLUTION:
Apply vendor patch.
http://developer.elasticpath.com/servlet/KbServlet/download/1334-102-41/ep4_security_vulnerabilities_fix_1.1.zip

PROVIDED AND/OR DISCOVERED BY:
Daniel Martin Gomez, MWR InfoSecurity

ORIGINAL ADVISORY:
MWR InfoSecurity:
http://www.mwrinfosecurity.com/publications/mwri_elastic-path-arbitrary-file-system-access_2008-02-22.pdf

Elastic Path:
http://developer.elasticpath.com/entry!default.jspa?categoryID=4&externalID=1334

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------