BugTraq
LSE Leading Security Experts GmbH - LSE-2016-02-03 - OXID eShop Path Traversal Vulnerability May 03 2016 04:40PM
LSE-Advisories (advisories lsexperts de)
=== LSE Leading Security Experts GmbH - Security Advisory 2016-02-03 ===

OXID eShop Path Traversal Vulnerability
------------------------------------------------------------------------

Affected Versions
=================
Community Edition 4.9.7

Issue Overview
==============
Vulnerability Type: path traversal, privilege escalation
Version: Tested in Community Edition 4.9.7
Technical Risk: high
Likelihood of Exploitation: medium
Vendor: OXID eSales AG
Vendor URL: https://www.oxid-esales.com
Credits: LSE Leading Security Experts GmbH employee Tim Herres
Advisory URL: https://www.lsexperts.de/advisories/lse-2016-02-03.txt
Advisory Status: Public
CVE-Number: NA
CVE URL: NA
OVE-ID:OVE-20160419-0002
OVI-ID:OVI-2016-7988
CWE-ID: CWE-22
CVSS 2.0: 3.5 (AV:N/AC:M/Au:S/C:P/I:N/A:N)

Impact
======
A missing file path validation allows an authenticated user with permission
to add or edit products to read any file on the file system without permissions.

Issue Description
=================
While conducting an internal evaluation of the software, LSE Leading
Security Experts GmbH discovered a path traversal vulnerability in the product
downloads function. A user with permissions to change or add products may change
the Downloads name to a local file (e.g. "../../../config.inc.php"). This may lead
to a privilege escalation.

Temporary Workaround and Fix
============================
Install latest update 4.9.8/5.2.8
See http://wiki.oxidforge.org/Downloads/4.9.8_5.2.8

Proof of Concept
================
Create a new product in the backend. In the "Downloads" tab set "name of the uploaded
file" to "../../../config.inc.php". Go to the frontend and buy the related product.
Move to "My account" and choose the download section. Download the file and enjoy
full database credentials.

History
=======
2016-02-05 Issue discovered
2016-02-22 Vendor contacted
2016-02-24 Vendor confirmed
2016-05-03 Vendor released patch
2016-05-03 Advisory release

GPG Signature
=============
This advisory is signed with the GPG key of the
LSE Leading Security Experts GmbH advisories team.
The key can be downloaded here: https://www.lsexperts.de/advisories-key-99E3277C.asc

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJXKNR4AAoJEDgSCSGZ4yd8k0EP/j/fCLjwBo2FbMLy9tEykhtT
IdTzJUvoOn03OAWeGzou+SlyAd2yavlbogsyBpyQrGp/l44AaVERjYsQR2BAvcYB
veend/0ptLZZ66IzZd8t7oyS5KQUpEQaef8Y6PydNbPwVQzJn/Z53hXsYXJ/3AKj
ZQHGRpDv8v//Qk6jw14rMmJt6s8H7Yij32e0cIRgHHIewyO4rUTp8JdheDbFY+nM
AONt9hRSR85icZw33ADhx/nnLwvXu9XrJbjZYlsWIa7Z1Btna+IpNkWvDOg4Bypu
ANljhbj9W/24AkxXaQqpT5s6PWsg8MPmKuQ2vcCa6XuAXHcZr9gptUi93eMgbeQd
OBla/x6AN9jgvgkf67QLJFYKgxhIc80DxtJK33/gGOkdn+tq22TeI5C3+yFS3ods
F1eD2UsjBOdIzLTV61l/R4p91TP+U9pnvzaEd6PIUAQCyk11ElAyTJ0+m1wVNRi6
aG7kicWBLVNQpCL7YLWbvGp8Y7OkUx/esdZHObVCMZwYbZ8L51J+RgYvMGJtPleV
unm297QVkNm6Dr/OJSMbCAzkryVGs/xbI6HCF4n0sosA8Lvi6tfXpKWzxBPJqH8G
QTHN/cg8QRkG7Qefvnzb7NIm6tVjGZNufmMFJhLE9TtcRhCzQoLYFTALelS61tO4
LLKV+znLcAy6LUKGIIbG
=oz0h
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus