####################################################################### Luigi Auriemma Application: Easy File Sharing Web Server http://www.sharing-file.com Versions: <= 4.5 Platforms: Windows Bugs: A] upload directory traversal B] download of database files C] possibility of reading sensitive files Exploitation: remote Date: 07 Dec 2007 Author: Luigi Auriemma e-mail: aluigi@autistici.org web: aluigi.org ####################################################################### 1) Introduction 2) Bugs 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== Easy File Sharing Web Server is a commercial file sharing software which allows the downloading and the uploading of files through the web browser. ####################################################################### ======= 2) Bugs ======= ----------------------------- A] upload directory traversal ----------------------------- An attacker can upload a specific file outside the destination folder with the possibility of overwriting those already existent using the upload feature available for the user's folder, the forum and the other possible virtual folders. The attacker must have the needed privileges for uploading files (by default guests can upload files on the forum so in this case there are no problems) and "Allow files to be overwritten" (enabled by default) must be active for owerwriting the existent files. ----------------------------- B] download of database files ----------------------------- All the .sdb database files (MyDB, http://www.mghsoft.com) except admin.sdb and user.sdb can be downloaded from external users which can retrieve some sensitive informations from them. These informations can be very useful in conjunction to the other vulnerabilities described in this advisory. ----------------------------------------- C] possibility of reading sensitive files ----------------------------------------- By default when an user registers an account on the server a new folder with his name is created in the users folder (by default c:\). If the user uses the same name of an existent file in that folder (for example boot.ini) he and any other external client will be able to read that file if they access to that virtual folder. Note that doesn't seem possible to use directory traversal tricks and directories. Due to the low risk of this bug it's reported here only for thoroughness. ####################################################################### =========== 3) The Code =========== A] http://aluigi.org/poc/efsup.zip B] http://SERVER/vfolder.sdb C] create a new account using the name of a file existent in the users folder, for example boot.ini, then (without the need to login) go on http://SERVER/boot.ini and you will see the content of c:\boot.ini ####################################################################### ====== 4) Fix ====== The bugs will be fixed in a future version. ####################################################################### --- Luigi Auriemma http://aluigi.org