AWstats Path Disclosure Vulnerability

[fournaux@khmerdev.com]

Good morning all.

"AWStats is a free powerful and featureful tool that generates advanced web, streaming, ftp or mail server statistics, graphically. This log analyzer works as a CGI or from command line and shows you all possible information your log contains, in few grap
hical web pages."

Once you have setup this tool, you can get statistics of a website with this URL :

http://www.server.com/awstats/awstats.pl?config=xxx

You replace xxx by the name you gave to the configuration file of your website (You have one file per website)

But if xxx is not an existing name, the path will be disclosed to the user in the resulting error message.

I have seen this vulnerability with 6.4 version of AWstats and i think all version < 6.4 are also vulnerable.

AWstats is a great tool anyway.

Sorry for my english it is not my primary language.

Have a nice day. Unix will win.

Best regards.

FOURNAUX Nicolas

www.cambodiaoutsourcing.com
www.khmerdev.com

[Fournaux]

Hi !

If you use this url :
http://www.server.com/awstats/awstats.pl?config=xxx

You will get the full path on the hard drive of the script "awstats.pl"
with all sub folders.
To prevent an attack, this is the kind of information you should hide.

If you search "full path disclosure" on google or on bugtraq you will
find many security issue.
It is not a critical vulnerability but we should be aware.

Best regards.

FOURNAUX Nicolas
-----------------------
www.cambodiaoutsourcing.com
www.khmerdev.com

Martin Pitt a écrit :

>Hi!
>
>fournaux@khmerdev.com [2005-08-26 1:58 -0000]:
>
>
>>Once you have setup this tool, you can get statistics of a website
>>with this URL :
>>
>>http://www.server.com/awstats/awstats.pl?config=xxx
>>
>>You replace xxx by the name you gave to the configuration file of
>>your website (You have one file per website)
>>
>>But if xxx is not an existing name, the path will be disclosed to
>>the user in the resulting error message.
>>
>>
>
>I'm afraid I don't understand this properly - You request
>http://some.url?config=/path/to/nonexistant and the error page
>displays exactly this path? How can this be a vulnerability? AFAICS
>this can only determine whether a file exists or not, but this is
>really picky...
>
>Thanks for any clarification,
>
>Martin
>
>

[cwh01@www78.dixiesys.com]

Thing is, it's a MINOR bug. Since most people install it in the default
/cgi-gin and usually under /awstats, it doesn't give much ammo other then
possibly the userid of the account. And since a LOT of ppl use something
easy like "admin" or a shortened version of teh domain name like
"domai00", it's not hard to guess the paths. Besides, a lot of ppl also
have a phpinfo.php file on their sites or servers...that gives you much
more information then this does.

This is nothing more then a minor bug then a real security issue.

> Hi !
>
> If you use this url :
> http://www.server.com/awstats/awstats.pl?config=xxx
>
> You will get the full path on the hard drive of the script "awstats.pl"
> with all sub folders.
> To prevent an attack, this is the kind of information you should hide.
>
> If you search "full path disclosure" on google or on bugtraq you will
> find many security issue.
> It is not a critical vulnerability but we should be aware.
>
> Best regards.
>
> FOURNAUX Nicolas
> -----------------------
> www.cambodiaoutsourcing.com
> www.khmerdev.com
>
> Martin Pitt a écrit :
>
>>Hi!
>>
>>fournaux@khmerdev.com [2005-08-26 1:58 -0000]:
>>
>>
>>>Once you have setup this tool, you can get statistics of a website
>>>with this URL :
>>>
>>>http://www.server.com/awstats/awstats.pl?config=xxx
>>>
>>>You replace xxx by the name you gave to the configuration file of
>>>your website (You have one file per website)
>>>
>>>But if xxx is not an existing name, the path will be disclosed to
>>>the user in the resulting error message.
>>>
>>>
>>
>>I'm afraid I don't understand this properly - You request
>>http://some.url?config=/path/to/nonexistant and the error page
>>displays exactly this path? How can this be a vulnerability? AFAICS
>>this can only determine whether a file exists or not, but this is
>>really picky...
>>
>>Thanks for any clarification,
>>
>>Martin
>>
>>
>

[Martin Pitt]

--q9KOos5vDmpwPx9o
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi Nicolas!

Fournaux [2005-09-15 2:58 +0200]:
> If you use this url :
> http://www.server.com/awstats/awstats.pl?config=3Dxxx
>=20
> You will get the full path on the hard drive of the script "awstats.pl"=
=20
> with all sub folders.

Ah, I see; I thought you meant the path of the configuration file.

Well, that makes it even less of a problem for distributions since the
path of program files of installed packages is common knowledge
anyway.

It might be a problem in custom installations, though.

Thanks for the clarification,

Martin
--=20
Martin Pitt http://www.piware.de
Ubuntu Developer http://www.ubuntulinux.org
Debian Developer http://www.debian.org

--q9KOos5vDmpwPx9o
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDKSpSDecnbV4Fd/IRArPSAKDUaA+PeWso5KdW6zQBCNM9UuHy7ACffbE4
0eB8o7H2oUXXFo83gBaQnmk=
=tZ5R
-----END PGP SIGNATURE-----

--q9KOos5vDmpwPx9o--