[UNIX] Trac Fileupload/download Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Trac Fileupload/download Vulnerability
------------------------------------------------------------------------


SUMMARY

" <http://www.edgewall.com> Trac is an enhanced Wiki and issue tracking 
system for software development projects. Trac uses a minimalistic 
approach to web-based software project management. Our mission; to help 
developers write great software while staying out of the way. Trac should 
impose as little as possible on a team's established development process 
and policies.

It provides an interface to Subversion, an integrated Wiki and convenient 
report facilities.

Trac allows wiki markup in issue descriptions and commit messages, 
creating links and seamless references between bugs, tasks, changesets, 
files and Wiki pages. A timeline shows all project events in order, making 
getting an overview of the project and tracking progress very easy."

During the evaluation of Trac an input validation vulnerability was 
discovered which can lead to arbitrary up- and downloading of files with 
the permission of the web server. Under some circumstances this can lead 
remote code execution, depending on the configuration of the web server 
and the permissions on the directories within the document root.

DETAILS

Vulnerable Systems:
 * Trac version 0.8.3 and prior

Immune Systems:
 * Trac version 0.8.4

Trac's wiki and ticket systems allows to add attachments to wiki entries 
and bug tracker tickets. These attachments are stored within directories 
that are determined by the id of the corresponding ticket or wiki entry.

Due to a missing validation of the id parameter it is possible for an 
attacker to supply arbitrary paths to the upload and attachment viewer 
scripts. This means that a potential attacker can retrieve any file 
accessible by the web server user.

Additionally it is possible to upload arbitrary files (up to a configured 
file length) to any place the webserver has write access too.

For obvious reasons this can lead to the execution of arbitrary code if it 
possible to upload files to the document root or it's subdirectories. One 
example of a configuration would be f.e. running Trac and s9y/wordpress 
with write-able content directories on the same web server.

Another potential usage of this exploit would be to abuse Trac powered web 
servers as storage for f.e. torrent files.

Disclosure Timeline:
16. June 2005 - Contacted edgewall via email
19. June 2005 - Vendor released bug fixed version
20. June 2005 - Public disclosure

Recommendation:
We strongly recommend to upgrade to the vendor supplied new version Trac 
0.8.4  <http://ftp.edgewall.com/pub/trac/trac-0.8.4.tar.gz> 
http://ftp.edgewall.com/pub/trac/trac-0.8.4.tar.gz


ADDITIONAL INFORMATION

The information has been provided by  <mailto:[email protected]> 
Stefan Esser.
The original article can be found at:  
<http://www.hardened-php.net/advisory-012005.php> 
http://www.hardened-php.net/advisory-012005.php



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.