MiniWeb Multiple Vulnerabilities

vendor:

MiniWeb

by:

Hamid Ebadi

7.5

CVSS

HIGH

Directory Traversal and Heap Based Buffer Overflow

22, 119

CWE

Product Name: MiniWeb

Affected Version From: MiniWeb 0.8.19

Affected Version To: MiniWeb 0.8.19

Patch Exists: NO

Related CWE: N/A

CPE: a:stanley_huang:miniweb

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: POSIX complaint OS, like Linux, as well as Microsoft Windows

2005

MiniWeb Multiple Vulnerabilities

An input validation error in the URL request handling in mwGetLocalFileName() function (http.c) can be exploited to disclose arbitrary files (and also Directory listing) outside the web root via directory traversals attacks via the " /.%2e/" or "/%2e%2e/" sequences. There is also heap based buffer overflow in this web server. The vulnerability is caused due to a boundary error in _mwProcessReadSocket() function (http.c) when handling HTTP requests. This can be exploited by sending an overly long, specially crafted request, which can cause a heap overflow and allow arbitrary code execution with the privileges of the web service.

Mitigation:

Edit the source code

Source

Exploit-DB raw data:

MiniWeb Multiple Vulnerabilities

Introduction
MiniWeb is a mini HTTP server implementation written in C language,
featuring low system resource consumption, high efficiency, good
flexibility and high portability.
It is capable to serve multiple clients with a single thread,
supporting GET and POST methods, authentication, dynamic contents
(dynamic web page and page variable substitution) and file uploading.
MiniWeb runs on POSIX complaint OS, like Linux, as well as Microsoft Windows.
	
vulnerability discovered by : Hamid Ebadi  (ebadi _AT_ bugtraq.ir)

http://www.bugtraq.ir

complete advisory and also source code auditing can be found at :

	http://www.bugtraq.ir/adv/miniweb_persian.pdf  (persian)
	http://www.bugtraq.ir/adv/miniweb_english.pdf  (english)

vulnerable version : MiniWeb 0.8.19 (C)2005 Written by Stanley Huang
http://miniweb.sourceforge.net/
http://sourceforge.net/projects/miniweb

Description:

directory traversals  :

An input validation error in the URL request handling in
mwGetLocalFileName()   function ( http.c)  can  be exploited to
disclose arbitrary files (and also Directory listing)  outside the web
root via directory traversals  attacks via the " /.%2e/" or "/%2e%2e/"
 sequences

Proof of Concept :
Directory listing:
http://127.0.0.1:80/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/

disclose arbitrary files:
http://127.0.0.1:80/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/boot.ini


Heap based buffer overflow vulnerability :

There is also heap based buffer overflow in this web server
The vulnerability is caused due to a boundary error in
_mwProcessReadSocket() function (http.c) when handling HTTP requests.
This can be exploited by sending an overly long, specially crafted
request, which can cause a heap overflow and allow arbitrary code
execution with the privileges of the web service.


Proof of Concept :
GET /AAAA...[3600 - 4000]...AAAA/ HTTP/1.0

Solution:
Edit the source code (for more information see this article)

http://www.bugtraq.ir/adv/miniweb_persian.pdf  (persian)
http://www.bugtraq.ir/adv/miniweb_english.pdf  (english)

Copyright  : http://www.bugtraq.ir

# milw0rm.com [2008-01-16]