Re: Security bug in pyblosxom (reading of arbitrary directories)

PyBlosxom 1.3.1 has two lines in pyblosxom.py before line 1040 like this:

     if path_info.startswith("/"):
         path_info = path_info[1:]

So when passed a path_info o "/etc", it strips off the first / making it 
"etc".  However, it won't strip multiple / and that's a possible issue.

So I tried:

    http://site/cgi-bin/pyblosxom.cgi///etc

and the ///etc gets turned into "/etc" by the web-server.  I'm running 
Apache 2.0.55 (Debian's apache2 2.0.55-1 package) and running PyBlosxom as 
a cgi script.

I'll adjust the code to fix the possibility of having multiple / and I'll 
look for other os.path.join issues, but I can't reproduce this issue and I 
don't know what situations it pops up in.

If anyone else can reproduce this issue with PyBlosxom 1.3.1 and what 
situations they can reproduce it in, that'd help a lot.

/will


On Sun, 12 Feb 2006, Lance Levsen wrote:
> 
> will guaraldi wrote:
>>
>> I'm unable to reproduce the issue you're seeing. All I get is "The page 
>> you are looking at is unavailable".
>>
>> What version of PyBlosxom are you using?  What version of Python are 
>> you using?  What's your datadir property set to?
>>
>> /will
>
> Likewise. No directory traversal here.
>
> Cheers,
> lance


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642