Path Traversal

vendor:

Voyager

by:

SecurityFocus

8.8

CVSS

HIGH

Path Traversal

CWE

Product Name: Voyager

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: No

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2001

The web server supplied with the QNX Voyager demo disk contains a vulnerability in which it will follow relative paths passed to it in requests, including ../ style paths, which will allow Voyager to serve pages outside of the "document root". Additionally, the web server does not have sufficient security restrictions, allowing it to access any file, including protected files and special /dev entries. DoS attacks can be performed by requesting files under /.photon/ and recent PPP passwords can be exposed by requesting files under /etc/ppp/.

Mitigation:

Users should not use the Voyager web server in a production environment.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/1648/info

The web server supplied with the QNX Voyager demo disk contains several vulnerabilities.

First, Voyager will follow relative paths passed to it in requests. This includes ../ style paths, which will allow Voyager to serve pages outside of the "document root".
Another vulnerability is that the web server does not have sufficient security restrictions - this means that the web server can access any file, including protected files and special /dev entries.

As well, due to the integration of the web browser and web server, information used by the Photon GUI is easily exposed by requesting files under /.photon/. Additionally, html files generated by the web browser (error messages, for example) and the QNX configuration interface share the same directory as published html files.

While the Voyager web server is not intended to be used in a production environment, and is in fact intended only to be a demo of the QNX OS, users should be aware of these design errors.

DoS the web server:
http://target/../../dev/dns

Recent PPP passwords (modem build of Voyager):
http://target/../../etc/ppp/chap-secrets
http://target/../../etc/ppp/pap-secrets