[DCA-2011-0015] QuesCom Qportal User - OctoWebSvr/COM - Source Code Disclosure

[Ewerson Guimarães (Crash) - Dclabs <crash () dclabs com br>]

[Discussion]
- DcLabs Security Research Group advises about the following vulnerability(ies):
[Software]
- QuesCom Qportal User
[Vendor Product Description]
- No vendor product description
- Site: http://www.quescom.com/
[Advisory Timeline]
- 12/01/2011 -> First Contact requesting security department contact;-
12/01/2011 -> Vendor reply .- 12/01/2011 -> Adv. sent to vendor.-
12/05/2011 -> Vendor reply .- 12/05/2011 -> Video sent to vendor .-
12/06/2011 -> Vendor reply .- 12/07/2011 -> Published

[Bug Summary]
-  Asp source code disclosure
[Impact]
- High
[Affected Version]
- Version:5.10.014
[Bug Description and Proof of Concept]
Attackers use source code disclosure attacks to try to obtain the
source code of server-side applications. The basic role of Web servers
is to serve files as requested by clients. Files can be static, such
as image and HTML files, or dynamic, such as ASP, JSP and PHP files.
When the browser requests a dynamic file, the Web server first
executes the file and then returns the result to the browser. Hence,
dynamic files are actually code executed on the Web server.
http://www.imperva.com/resources/glossary/source_code_disclosure.html


POC
http://server/remotefile.asp%20http://server/remotefile.asp::$DATA
Characters other than %20 and ::$DATE may also be used to disclose the
source code.
All flaws described here were discovered and researched by:
Ewerson Guimaraes aka CrashDcLabs Security Research Groupcrash (at)
dclabs <dot> com <dot> br
[Patch(s) / Workaround]
Version 6.21 fixes the issue.
[Greetz]DcLabs Security Research Group.
--
Ewerson Guimaraes (Crash)
Pentester/Researcher
DcLabs Security Team
www.dclabs.com.br