[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

LSE Leading Security Experts GmbH - LSE-2016-02-03 - OXID eShop Path Traversal Vulnerability

=== LSE Leading Security Experts GmbH - Security Advisory 2016-02-03 ===

OXID eShop Path Traversal Vulnerability

Affected Versions
Community Edition 4.9.7

Issue Overview
Vulnerability Type: path traversal, privilege escalation
Version: Tested in Community Edition 4.9.7
Technical Risk: high
Likelihood of Exploitation: medium
Vendor: OXID eSales AG
Vendor URL: https://www.oxid-esales.com
Credits: LSE Leading Security Experts GmbH employee Tim Herres
Advisory URL: https://www.lsexperts.de/advisories/lse-2016-02-03.txt
Advisory Status: Public
CVE-Number: NA
CVSS 2.0: 3.5  (AV:N/AC:M/Au:S/C:P/I:N/A:N)

A missing file path validation allows an authenticated user with permission
to add or edit products to read any file on the file system without permissions.

Issue Description
While conducting an internal evaluation of the software, LSE Leading
Security Experts GmbH discovered a path traversal vulnerability in the product
downloads function. A user with permissions to change or add products may change
the Downloads name to a local file (e.g. "../../../config.inc.php"). This may lead
to a privilege escalation.

Temporary Workaround and Fix
Install latest update 4.9.8/5.2.8
See http://wiki.oxidforge.org/Downloads/4.9.8_5.2.8

Proof of Concept
Create a new product in the backend. In the "Downloads" tab set "name of the uploaded
file" to "../../../config.inc.php". Go to the frontend and buy the related product.
Move to "My account" and choose the download section. Download the file and enjoy
full database credentials.

2016-02-05 Issue discovered
2016-02-22 Vendor contacted
2016-02-24 Vendor confirmed
2016-05-03 Vendor released patch
2016-05-03 Advisory release

GPG Signature
This advisory is signed with the GPG key of the
LSE Leading Security Experts GmbH advisories team.
The key can be downloaded here: https://www.lsexperts.de/advisories-key-99E3277C.asc

Attachment: signature.asc
Description: OpenPGP digital signature