Advisory : Persistent Internet Storage

[Nico Le Moin <nicolemoin01 () gmail com>]

Hello All,

I want to inform you about a vulnerability in critical internet
infrastructure.

It is possible for unauthenticated users to upload arbitrary files to the
internet whereafter it is not possible to delete these files from the
internet.

This vulnerability has been exploited in the past against Ms. Barbara
Streisand. However a CVE has not yet been rewarded.

I have discovered new attack vectors which aggravate this vulnerability. In
the use case of mailing lists
  - emails might contain code that can be used for RFI
  - emails might be stored as .html resulting in XSS
  - emails might be stored as .php files resulting in RCE

Sincerely,

Nico Lemoin, ass. PhD
CISSP - C|EH

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/