---------------------------------------------------------------------- A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. Download and test it today: https://psi.secunia.com/ Read more about this new version: https://psi.secunia.com/?page=changelog ---------------------------------------------------------------------- TITLE: Elastic Path Multiple Directory Traversal Vulnerabilities SECUNIA ADVISORY ID: SA29496 VERIFY ADVISORY: http://secunia.com/advisories/29496/ CRITICAL: Moderately critical IMPACT: Security Bypass, Exposure of system information, Exposure of sensitive information, System access WHERE: >From remote SOFTWARE: Elastic Path 4.x http://secunia.com/product/18069/ DESCRIPTION: Daniel Martin Gomez has reported some vulnerabilities in Elastic Path, which can be exploited by malicious users to disclose sensitive information or to potentially compromise a vulnerable system. 1) Input passed to the "file" parameter in manager/getImportFileRedirect.jsp is not properly sanitised before being used to download files. This can be exploited to download arbitrary files via directory traversal attacks. 2) Input passed via the file name when uploading files in importData.jsp is not properly sanitised before being used to upload files. This can be exploited to upload files to arbitrary directories via directory traversal attacks. 3) Input passed to the "dir" parameter in manager/fileManager.jsp is not properly sanitised before being used to list files. This can be exploited to list the content of arbitrary directories via directory traversal attacks. Successful exploitation of the vulnerabilities requires that the user has download and upload privileges. The vulnerabilities are reported in versions 4.1 and 4.1.1. Prior versions may also be affected. SOLUTION: Apply vendor patch. http://developer.elasticpath.com/servlet/KbServlet/download/1334-102-41/ep4_security_vulnerabilities_fix_1.1.zip PROVIDED AND/OR DISCOVERED BY: Daniel Martin Gomez, MWR InfoSecurity ORIGINAL ADVISORY: MWR InfoSecurity: http://www.mwrinfosecurity.com/publications/mwri_elastic-path-arbitrary-file-system-access_2008-02-22.pdf Elastic Path: http://developer.elasticpath.com/entry!default.jspa?categoryID=4&externalID=1334 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------