Limited upload directory traversal in HTTP File Server 2.2a / 2.3 beta (build #146)

[Luigi Auriemma <aluigi () autistici org>]

#######################################################################

                             Luigi Auriemma

Application:  HTTP File Server
              http://www.rejetto.com/hfs/
Versions:     <= 2.2a and <= 2.3 beta (build #146)
Platforms:    Windows
Bug:          limited directory traversal in files uploading
Exploitation: remote
Date:         05 Dec 2007
Author:       Luigi Auriemma
              e-mail: aluigi () autistici org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


HFS is a very nice and small file server for Windows easy to use and
with many interesting features.


#######################################################################

======
2) Bug
======


HFS allows the uploading of files to the real folders added to the
Virtual File System.
The problem is that an attacker can upload files outside the
destination folder reaching the root or any other directory on the disk
in which is located the upload folder using the ../ pattern.

Note that uploading must be enabled on the target folder, that the
attacker must have access to it (is possible to restrict the access to
that folder to a specific account) and that is not possible to
overwrite existing files because the server avoids it (for example if a
file called file.txt already exists the new one will be called
file(1).txt).


#######################################################################

===========
3) The Code
===========


http://aluigi.org/testz/myhttpup.zip

  myhttpup http://SERVER/folder file.txt ../../../file.txt


#######################################################################

======
4) Fix
======


2.2b #150 and 2.3 beta #160


#######################################################################


--- 
Luigi Auriemma
http://aluigi.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/