Directory Traversal in Sojourn Search Engine

vendor:

Sojourn Search Engine

by:

SecurityFocus

7.5

CVSS

HIGH

Directory Traversal

CWE

Product Name: Sojourn Search Engine

Affected Version From: Sojourn Search Engine

Affected Version To: Sojourn Search Engine

Patch Exists: No

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2001

Directory Traversal in Sojourn Search Engine

A vulnerability in the Sojourn search engine allows an attacker to read any file that the webserver has read access to. This is done by making a request for a URL like http://target/cgi-bin/sojourn.cgi?cat=categoryname, where the program appends the .txt extension onto the contents of the 'cat' variable. However, the program will accept and follow the '../' string in the variable contents, allowing read access to any .txt file the webserver can read. This restriction can be bypassed by appending %00 to the end of the requested file, which will prevent the .txt extension from being used in the filename.

Mitigation:

Restrict access to the sojourn.cgi script and ensure that the webserver does not have read access to sensitive files.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/1052/info

Any file that the webserver has read access to can be read on a server running the Sojourn search engine.

The Sojourn software includes the ability to organize a website into categories. These categories can then be accessed via the sojourn.cgi Perl script. This is done by making a request for a URL like:

http ://target/cgi-bin/sojourn.cgi?cat=categoryname

Each category has an associated .txt file based on the category name. The program appends the .txt extension onto the contents of the 'cat' variable. However, the program will accept and follow the '../' string in the variable contents, allowing read access to any .txt file the webserver can read.

This restriction can be bypassed by appending %00 to the end of the requested file, which will prevent the .txt extension from being used in the filename.

http ://target/cgi-bin/sojourn.cgi?cat=../../../../../../etc/passwd%00