SoftArtisans FileUp viewsrc.asp remote script source disclosure exploit
Advisory Name: SoftArtisans FileUp(TM) viewsrc.asp remote script source disclosure exploit
Tested and Confirmed Vulerable: SoftArtisans SAFileUp(TM) 5.0.14 (Standard)
Severity: High Type: Script
source disclosure From where: Remote
Discovered by: Inge Henriksen (http://ingehenriksen.blogspot.com/)
Vendor Status: Notified Overview:
SoftArtisans FileUp(TM) is a popular web server component for transactional uploading of files to a
web server using a web browser.
When installing SoftArtisans FileUp(TM) you should avoid installing the samples as viewsrc.asp can
let remote anonymous users see script source code or configuration settings outside the
/SAFileUpSamples virtual directory. This is accomplished by modifying the "path" query variable to
point to files outside the designated directory. A web browser from a remote location is a
sufficient tool to see the source code or configuration settings in plain text.
Proof-of Concept:
The following url would show the configuration settings for www.example.xom:
http://www.example.xom/SAFileUpSamples/util/viewsrc.asp?path=/SAFileUpSamples/%c0%ae./%c0%ae./web.config
The %c0%ae is Unicode for the "." character on a english language server, the url is therefore
interpreted by the server as
http://www.example.xom/SAFileUpSamples/util/viewsrc.asp?path=/SAFileUpSamples/../../web.config, in
addition the unicode character avoids the security checks inside the code of viewsrc.asp which won't
let any ".." pass through. Keep in mind that other unicode's will also work. Also note that OS'es
with other language settings will be vulnerable to different unicodes, thus %c0%ae might not work on
a chinese server but some other unicode's should work just as well.
# milw0rm.com [2006-12-30]
