OpenX up to 2.8.10 plugin-settings.php group path traversal

Summaryinfo

A vulnerability was found in OpenX. It has been declared as critical. This affects an unknown part of the file admin/plugin-settings.php. The manipulation of the argument group results in path traversal. This vulnerability is known as CVE-2013-3514. Furthermore, an exploit is available. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability was found in OpenX. It has been classified as critical. Affected is some unknown processing of the file admin/plugin-settings.php. The manipulation of the argument group with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Multiple directory traversal vulnerabilities in OpenX before 2.8.10 revision 82710 allow remote administrators to read arbitrary files via a .. (dot dot) in the group parameter to (1) plugin-preferences.php or (2) plugin-settings.php in www/admin, a different vulnerability than CVE-2013-7376. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to read arbitrary files.

The weakness was published 07/03/2013 with High-Tech Bridge SA as confirmed mailinglist post (Bugtraq). The advisory is available at seclists.org. The public release has been coordinated with the vendor. This vulnerability is traded as CVE-2013-3514 since 05/08/2013. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details and a public exploit are known. This vulnerability is assigned to T1006 by the MITRE ATT&CK project.

A public exploit has been developed by High-Tech Bridge SA and been published immediately after the advisory. The exploit is shared for download at htbridge.com. It is declared as proof-of-concept. By approaching the search of inurl:admin/plugin-settings.php it is possible to find vulnerable targets with Google Hacking.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at htbridge.com.

The vulnerability is also documented in the databases at Exploit-DB (26624) and OSVDB (94776†). Similar entries are available at VDB-9328, VDB-9329, VDB-9331 and VDB-9332. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• OpenX

Version

• 2.4
• 2.4.4
• 2.4.5
• 2.4.6
• 2.4.7
• 2.4.8
• 2.4.9
• 2.4.10
• 2.4.11
• 2.6.0
• 2.6.1
• 2.6.2
• 2.6.3
• 2.6.4
• 2.6.5
• 2.7.29
• 2.8
• 2.8.1
• 2.8.2
• 2.8.3
• 2.8.4
• 2.8.5
• 2.8.6
• 2.8.7
• 2.8.8
• 2.8.9
• 2.8.10

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion