ForbiddenServer
$ R00T
- Joined
- Sep 15, 2013
- Messages
- 26
- Reaction score
- 9
VULNERABILITY
-------------------------
XAMPP 1.8.1 Local Write Access Vulnerability
BACKGROUND
-------------------------
XAMPP is a free and open source cross-platform web server solution stack
package, consisting mainly of the Apache HTTP Server, MySQL database, and
interpreters for scripts written in the PHP and Perl programming languages.
DESCRIPTION
-------------------------
It has been detected than an unprivileged user can write in the local
disk and the local file "lang.tmp" can be modified in the remote machine.
The injection is done through the page "/xampp/lang.php".
PROOF OF CONCEPT
-------------------------
Malicious Request
http://vulnerablesite.com/xampp/lang.php?WriteIntoLocalDisk
And next, if we access to the file:
http://vulnerablesite.com/xampp/lang.tmp
We can verify that the file was modified.
BUSINESS IMPACT
-------------------------
An attacker can execute arbitrary HTML or script code in a targeted
user's browser, this can leverage to steal sensitive information as user
credentials,
personal data, etc.
SYSTEMS AFFECTED
-------------------------
XAMPP 1.8.1
SOLUTION
-------------------------
All data received by the application that can be modified by the user
must be validated.
REVISION HISTORY
------------------------
March 14, 2013: Initial release
September 26, 2013: Final release
DISCLOSURE TIMELINE
-------------------------
March 14, 2013: Vulnerability acquired by Internet Security
Auditors (www.isecauditors.com).
March 16, 2013: CVE-ID received.
March 18, 2013: Sent to Development Manager.
August 30, 2013: New version that includes patched code.
September 26, 2013: Sent to lists.
LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with
no warranties or guarantees of fitness of use or otherwise. Internet
Security
Auditors accepts no responsibility for any damage caused by the use or
misuse of this information.
ABOUT
-------------------------
Internet Security Auditors is a Spain based leader in web application
testing, network security, penetration testing, security compliance
implementation and
assessing. Our clients include some of the largest companies in areas
such as finance, telecommunications, insurance, ITC, etc. We are vendor
independent
provider with a deep expertise since 2001. Our efforts in R&D include
vulnerability research, open security project collaboration and
whitepapers,
presentations and security events participation and promotion. For
further information regarding our security services, contact us.
-------------------------
XAMPP 1.8.1 Local Write Access Vulnerability
BACKGROUND
-------------------------
XAMPP is a free and open source cross-platform web server solution stack
package, consisting mainly of the Apache HTTP Server, MySQL database, and
interpreters for scripts written in the PHP and Perl programming languages.
DESCRIPTION
-------------------------
It has been detected than an unprivileged user can write in the local
disk and the local file "lang.tmp" can be modified in the remote machine.
The injection is done through the page "/xampp/lang.php".
PROOF OF CONCEPT
-------------------------
Malicious Request
http://vulnerablesite.com/xampp/lang.php?WriteIntoLocalDisk
And next, if we access to the file:
http://vulnerablesite.com/xampp/lang.tmp
We can verify that the file was modified.
BUSINESS IMPACT
-------------------------
An attacker can execute arbitrary HTML or script code in a targeted
user's browser, this can leverage to steal sensitive information as user
credentials,
personal data, etc.
SYSTEMS AFFECTED
-------------------------
XAMPP 1.8.1
SOLUTION
-------------------------
All data received by the application that can be modified by the user
must be validated.
REVISION HISTORY
------------------------
March 14, 2013: Initial release
September 26, 2013: Final release
DISCLOSURE TIMELINE
-------------------------
March 14, 2013: Vulnerability acquired by Internet Security
Auditors (www.isecauditors.com).
March 16, 2013: CVE-ID received.
March 18, 2013: Sent to Development Manager.
August 30, 2013: New version that includes patched code.
September 26, 2013: Sent to lists.
LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with
no warranties or guarantees of fitness of use or otherwise. Internet
Security
Auditors accepts no responsibility for any damage caused by the use or
misuse of this information.
ABOUT
-------------------------
Internet Security Auditors is a Spain based leader in web application
testing, network security, penetration testing, security compliance
implementation and
assessing. Our clients include some of the largest companies in areas
such as finance, telecommunications, insurance, ITC, etc. We are vendor
independent
provider with a deep expertise since 2001. Our efforts in R&D include
vulnerability research, open security project collaboration and
whitepapers,
presentations and security events participation and promotion. For
further information regarding our security services, contact us.
