####################################################################### Luigi Auriemma Application: HTTP File Server http://www.rejetto.com/hfs/ Versions: <= 2.2a and <= 2.3 beta (build #146) Platforms: Windows Bug: limited directory traversal in files uploading Exploitation: remote Date: 05 Dec 2007 Author: Luigi Auriemma e-mail: aluigi@autistici.org web: aluigi.org ####################################################################### 1) Introduction 2) Bug 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== HFS is a very nice and small file server for Windows easy to use and with many interesting features. ####################################################################### ====== 2) Bug ====== HFS allows the uploading of files to the real folders added to the Virtual File System. The problem is that an attacker can upload files outside the destination folder reaching the root or any other directory on the disk in which is located the upload folder using the ../ pattern. Note that uploading must be enabled on the target folder, that the attacker must have access to it (is possible to restrict the access to that folder to a specific account) and that is not possible to overwrite existing files because the server avoids it (for example if a file called file.txt already exists the new one will be called file(1).txt). ####################################################################### =========== 3) The Code =========== http://aluigi.org/testz/myhttpup.zip myhttpup http://SERVER/folder file.txt ../../../file.txt ####################################################################### ====== 4) Fix ====== 2.2b #150 and 2.3 beta #160 ####################################################################### --- Luigi Auriemma http://aluigi.org