Security bug in pyblosxom (reading of arbitrary directories)
FX <[email protected]>
| Newsgroups | gmane.comp.web.pyblosxom.devel |
|---|---|
| Organization | Phenoelit (http://www.phenoelit.de/) |
| Message-ID | <[email protected]> |
Hi,
Requesting http://site/cgi-bin/pyblosxom.cgi//etc/ will cause /etc to be
parsed as datadir and anyone with a webbrowser sees /etc/ files as blog
entries. Why? Here it is:
pyblosxom.py:1040
absolute_path = os.path.join(config["datadir"], path_info)
When checking the python docs, it says for os.path.join: Joins one or more
path components intelligently. If any component is an absolute path, all
previous components are thrown away, and joining continues.
So, what does that mean to our absolute_path? The config["datadir"] part goes
where the documentation says it will: into the bitbucket, since path_info is
an absolute path.
I'm not a Python coder, so I leave the fix up to the developers.
cheers
FX
--
FX <[email protected]>
Phenoelit (http://www.phenoelit.de)
672D 64B2 DE42 FCF7 8A5E E43B C0C1 A242 6D63 B564
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642