Onderwerp: directory traversal in ParaChat Server 5.5

Donato Ferrante


Application: ParaChat Server
http://www.parachat.com/

Version: 5.5

Bug: directory traversal

Date: 28-Sep-2004

Author: Donato Ferrante
e-mail: fdonato@autistici.org
web: www.autistici.org/fdonato



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxx

1. Description
2. The bug
3. The code
4. The fix



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxx

----------------
1. Description:
----------------

Vendor's Description:

"ParaChat Server v5.5 is a fast, easy and affordable way to host and
manage your own real-time communication software - for one web site,
or for multiple web sites."



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxx

------------
2. The bug:
------------

The server is not able to manage the sequence "..%5C/", that is
equal to "..\/", this lets an attacker to navigate through the
victim system simply using a web browser.



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxx

-------------
3. The code:
-------------

To test the vulnerability:

http://[host]:7877/..%5C/..%5C/



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxx

------------
4. The fix:
------------

Vendor was contacted.
Bug will be fixed in the next version.



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxx

The vendor seems to have fixed the bug without changing the version number. So
the version 5.5 available from 29 September 2004 should be patched.


--
Donato Ferrante
www.autistici.org/fdonato