PT-2008-3162 · Elastic Path · Path

Published 2008-04-01 · Updated 2018-08-13 · CVE-2008-1606

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Elastic Path versions 4.1 through 4.1.1

Description The issue allows remote attackers to exploit multiple directory traversal vulnerabilities. This can be achieved by (1) downloading arbitrary files via a .. (dot dot) in the file parameter to "manager/getImportFileRedirect.jsp", (2) uploading arbitrary files via a ".." (dot dot backslash) in the file parameter to "importData.jsp", and (3) listing directory contents via a .. (dot dot) in the dir parameter to "manager/fileManager.jsp".

Recommendations For Elastic Path versions 4.1 through 4.1.1, consider restricting access to the "manager/getImportFileRedirect.jsp", "importData.jsp", and "manager/fileManager.jsp" endpoints until a patch is available. As a temporary workaround, avoid using the file and dir parameters in the affected API endpoints. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-1606

Affected Products

Path

References · 10

• 🔥 https://exploit-db.com/exploits/31446 · Exploit
• 🔥 https://exploit-db.com/exploits/31445 · Exploit
• 🔥 http://mwrinfosecurity.com/publications/mwri_elastic-path-arbitrary-file-system-access_2008-02-22.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-1606 · Security Note
• http://secunia.com/advisories/29496 · Vendor Advisory
• http://securityfocus.com/bid/28352 · Note
• http://developer.elasticpath.com/entry%21default.jspa?categoryID=4&externalID=1334 · Note
• http://weblog.nomejortu.com/?p=37 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41356 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41364 · Note