134 lines
4.8 KiB
Plaintext
134 lines
4.8 KiB
Plaintext
Date: Thu, 11 Feb 1999 17:37:18 -0500
|
|
From: Gary Geisbert <gary@NEWSLETTERS.COM>
|
|
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
|
|
Subject: Using FSO in ASP to view just about anything
|
|
|
|
|
|
This active server page opens the FileSystemObject and streams the contents
|
|
of the file specified in the "file" parameter. The problem with FSO is that
|
|
you can go 'outside' of the "\InetPub\wwwRoot\" directory using "../".
|
|
|
|
e.g.
|
|
http://www.server.foo/showfile.asp?file=../../global.asa
|
|
|
|
Another problem is that since the file is being read with a TextStream, ASP
|
|
code will not be executed. So if the file specified is an ASP file, the
|
|
results will be similar to the ::$DATA exploit.
|
|
|
|
For example: If this file was placed on the server of a web hosting company
|
|
who allows ASP, a malicious user could use it not only to view the source of
|
|
*any* other user's ASP code, but also (with a small modification) stream
|
|
data into other users' ASP files. This would essentially overwrite whatever
|
|
is currently there.
|
|
|
|
|
|
-------[ cut here: showfile.asp ]-------
|
|
|
|
<%
|
|
' grab the file from the URL
|
|
FileName = Request.QueryString("file")
|
|
|
|
' create the filesystemobject and open the file
|
|
Set fso = CreateObject("Scripting.FileSystemObject")
|
|
Set ts = fso.OpenTextFile(Server.MapPath(FileName))
|
|
|
|
' read the contents
|
|
ShowTheFreakinThing = ts.ReadAll
|
|
|
|
' display them
|
|
Response.Write ShowTheFreakinThing
|
|
|
|
' EOF
|
|
%>
|
|
|
|
-------[ cut here: showfile.asp ]-------
|
|
|
|
That's about it. Email me if you have questions.
|
|
|
|
-Gary Geisbert (gary@newsletters.com)
|
|
|
|
--------------------------------------------------------------------
|
|
|
|
Date: Thu, 11 Feb 1999 16:25:46 -0700
|
|
From: Joel Maslak <jmaslak@WIND-RIVER.COM>
|
|
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
|
|
Subject: Re: Using FSO in ASP to view just about anything
|
|
|
|
At 05:37 p.m. 11/02/99 -0500, you wrote:
|
|
>This active server page opens the FileSystemObject and streams the contents
|
|
>of the file specified in the "file" parameter. The problem with FSO is that
|
|
>you can go 'outside' of the "\InetPub\wwwRoot\" directory using "../".
|
|
|
|
Yes, this is a fairly well known bug.
|
|
|
|
Solution? NTFS permissions. Simply run each virtual web as a different
|
|
user, and make sure that user can't view each other's virtual webs, but
|
|
only it's own virtual web. This feature is actually quite useful when you
|
|
need to "break out of the mold" of traditional design.
|
|
|
|
One thing that should be noted is ANY ActiveX server can be executed by a
|
|
user, by simply doing a server.CreateObject in the ASP file. Obviously,
|
|
the security ramifications of this can be quite severe. You can open up MS
|
|
Outlook, and using the mail object, send mail. Neat feature for some
|
|
people, but scarry if you look at some the other interfaces in some of your
|
|
applications (think attachments!)... Do your users really have a
|
|
legitimate purpose in starting up, say, Word (never tried this, but I bet
|
|
it would work). This is a much bigger issue. An example of this use is at:
|
|
http://www.swynk.com/friends/datema/excelface.asp
|
|
|
|
It would be nice to have a way of limiting what objects can be created by
|
|
server.CreateObject (yes, I realize this is probably a big modification).
|
|
|
|
In addition to this feature, how about...
|
|
|
|
<!-- #include file="..\ANYDIR\ANYFILE.DAT" -->
|
|
|
|
You might be able to get access to any file stored on the server w/o
|
|
sufficient permissions (think credit card orders).
|
|
|
|
|
|
|
|
Joel Maslak
|
|
UPDATE -- Generate Web Traffic
|
|
http://www.permission-marketing.com/
|
|
|
|
--------------------------------------------------------------------
|
|
|
|
Date: Fri, 12 Feb 1999 10:51:07 -0500
|
|
From: Russ <Russ.Cooper@RC.ON.CA>
|
|
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
|
|
Subject: Re: Using FSO in ASP to view just about anything
|
|
|
|
Folks,
|
|
|
|
I would appreciate it if people would send their responses to Gary
|
|
(gary@newsletters.com) and I would ask Gary to summarize to the list.
|
|
|
|
I let Gary's message out not because it was a bug (and to that extent, I
|
|
should have asked Joel to change his message), but because it does
|
|
represent a reasonable vulnerability that could be easily overlooked.
|
|
|
|
In the meantime;
|
|
|
|
Phillip R. Paradis <paradis@exploremaine.com> said...
|
|
This exploit does not work in IIS4 if you deactivate the Allow Parent
|
|
Paths option in Internet Services Manager. Under the application root
|
|
properties, select configuration, app options, and deselect Allow Parent
|
|
Paths. This prevents MapPath from resolving anything with a .. in it.
|
|
|
|
Martin DEVERA <devik@cdi.cz> said...
|
|
>It would be nice to have a way of limiting what objects can be created
|
|
by
|
|
>server.CreateObject (yes, I realize this is probably a big
|
|
modification).
|
|
|
|
there is a way, you can set perms to a registry value
|
|
HKCR\Classes\{YourID} and so disallow particular user groups to read it.
|
|
It effectively disables user to create an object.
|
|
|
|
Cheers,
|
|
Russ - NTBugtraq moderator
|
|
|
|
|
|
|