19th Mar 2002 [SBWID-5190]
COMMAND
Hosting Controller directory traversal remote exploits
SYSTEMS AFFECTED
Tested on Hosting Controller, Windows 2000, version 1.4.1 with all
patches applied
PROBLEM
Phuong Nguyen posted :
Bug #1
File_editor.asp allows clients to edit their web pages online, without
the need to download, edit the pages and re-upload using FTP.
File_editor.asp is vulnerable to the /../ which allows attacker to
breakout his root path and edit any files on the hosts.
Bug #2
Folderactions.asp is also vulnerable to dot dot slash /../, allows
attacker to create, delete, files, directories on the server at his
choice. This is rather dangerous because Hosting Controller does not
perform proper permission checking and user right checking so the
attacker can delete anything he wants, the current patches from Hosting
Controller do NOT fix this.
If you combine those two bugs together then you actually can compromise
the server.
SOLUTION
Patch (NOT official) :
Here are fixed version of folderactions.asp and file_editor.asp. All
you need to do is replace your old *.asp files with these one.
--0-1224384856-1016491454=:63792
Content-Type: application/x-zip-compressed; name=\"fix.zip\"
Content-Transfer-Encoding: base64
Content-Description: fix.zip
Content-Disposition: attachment; filename=\"fix.zip\"
UEsDBBQAAAAIAApsbiw4BYeFtQYAAAwdAAARAAAAZm9sZGVyYWN0aW9ucy5h
c3DtWVtv4kYUfiZS/sOJqyRQEQhJt30opuXiZCMRSIHuqlKllbEH8K7x0PE4
Wf59z5yxjQmXBJao+1CUxJ7xOd+c6zeDUz39Hdp2MI7sMTM/NPqO8GYSTmvH
R9WTi4sfvMDxI5fBzV3bMo1Sqezw6ZQHZZz/FLIw9HjgTJjzpWSHM+Pi4jVq
fa32wRakBFrr9Pjo/OJtP7hCLnfj+WgW910mbEeiHaGyAh+B/uhJgMUMVKDu
ulqFIK6gxXwmExiau4YeC+xpZi5W/gks15Mwomkg2cF8xmCk/tKwAkvYZODx
0fFRruVNoU7mxINYh+4D9tTB9XCEP1oKTDTin4iFsvRHxMS8L4UXjPOGdsko
aFlvFINCtYauyQlT8DnC3oRADwmABS54I43ExZhc3qDkekI9JrXzH/f4JHoQ
MicSnpwDlZpaOmQYUgwUH37G5UMmHpkoNQWzJesOPzNH5g1dyWhJSUW0Pw8l
m+pnZFEoBVmL6kaI6XQk9DiXD7acwEhwjLw79YJPbS+U8DRhgoEKt3lunEFc
wHmDRDrkI5wZ50ZsmEOpWGtUvdVtNUpNHgRskRSUL3VnLID6bOZ7ji0JfCFU
+bS418HVHuBSIqxsX6rHHC7cPtNOo7heKfG+iGsXK8XruDDUc6t7kxaFGjd9
HqoyIzPTQY+FM+wdVvqIiWEpHpyBUR2KmrFGxhhMUHDGHG/kMRdmKtJPdggB
p5CNvCnOSg5DBlGgmgWtAEy8YIEEn4+9ACL0NASXT20cnMDyKlbgqgL1tYHo
jQLOx1VS0j1mfcV8hnkVA5XpQiF1ddnXZWdXPNFg8OShC3LihdoZlzPtDVOr
AFaB8qDb13Y+NzRupVwutjZ/p5KbmlY0/i6VsK6wSS+hAFysCpSzAnv5gUuA
p222fZ8/YQIwsORMEt4NZqs79esO064xAWtzmlfr33jMd8O8kTwzCoWNfi4Q
CgixtytriivNxwidy9SUriLBeULLJxBymPMINUh+Yj8y3Agc7HNVkEpHIMN5
ApEFC3kkHPaK+JDL6TDrTNaVvaiRyJHw8aev6cuxQ7bYL3JNNcxsXfntJF1I
dWh7e4HSi8lWpFVo93uVSnGtULyZGQsj3pHh2LuvMFuFWMdAxwM30pfj900f
XAHNgw57iitI7fdOBabMDrBkJrakopG2GLN077d95Gd3rtkhJI2r5xqZosSL
Lte4qp1kfplmCOcyeebQFuBCGFH1jiLfn5PENTAhEJA7yKi6zUlWnQP4iNZJ
PDk+GkWBPiEsikdfqEvpbIIPNSD2Q4RngIB9VdGnU4pm3HikmlspPxveuV91
sr59J89AIgKxS489ZixGKl0SRKk2G8msRAbjoqJkkajW7hyJ4IKlULLD5fp9
JhO1DK0lotrLdQHOEawlRCmIpkPMqyLGVH9BOT2GjaB631CYUzvAQzydqn9T
afGl6VyeJURrGrg5Z7KRS7fKnQCvtwGm1JdC74Bc2YycAie4O8BebYTNnGXV
bVL1/9PHIelDUfj/5PFa8sDrDtQxwLitBvgF8kgh1PkjPqTs1Kjy0Jwi34xT
5NtwivwOOYVYBVz9YsLOdL16ncDFuvbEY162jOl89n01aO6tOjRuUuWxmXkJ
sqlxM/212ov6ZZAWWenE1xeVu6Wt9ih9d5fST2KBobtaOJiNxlpiWsMqcTDW
kdJWVjpQoLIEtAvk5oZeoqC96G1bJrL0liblv6WQ+D2mTblXEyI9HigaUXQi
SMSlh5VnDAMOj7AH1QFjuCx59Vzy+UkkQ01oxAo1FeNviYekKDWDxzC1yEEI
6634KrZRvWpNtM4AcfDv0ovgg5HaPX+MKQ0ydi1CtambVWvs2iDi0AcK8XLH
wfF+tCq2MEXmhd7hiZUS4qX/u1hJx6HYdWsy9mPXren4VnbdlpAX2HWFYI+P
6P9e7wf3bbpa9Za63luDOnTq95Zp3Fodq1cfdHsGNHkgWSBN495zBA/5SMIH
L4xsH/oycj0OP5cuDaVeTnAa3dZfeM1Vm6jHBN0O6o22BR/vWoP35i/vTqFx
2+y2uz2z7/nIPNDo9lpWT081fNv5AvX23W3HdAghfmxWoGm12/2HevOucxuP
HuqtFo30Mj11wWsLv0d648A0NIJB07nqsFYdoT9I3j4XpkFLGbUehbhaVo9q
1fJQY5QHLcIsa9AM9nowTKFRqwfwZ7B4P2sRdXf1t8kiPPhMvfS75TBUPg7n
9I1S30dS6i+ZQ8GfQvUKl4MUc7DHthecbDcOLyq+NZXa6kPtLBiGs1+r5Qc9
UY4TghnSGf8XUEsDBBQAAAAIAA9sbiycifHD5gkAAEEfAAAPAAAAZmlsZV9l
ZGl0b3IuYXNwtVnpc9s2Fv/MzOh/gNGxLXVlynLSPRrJO66PTGaSyLXczZfO
ZCgSlJBQBBcAfbTT/33fw8FDh6t4U0eWCeDh3e+HB2a0d3T0Hc/jrEwYuXr7
7nJMw3AQi+VS5AOY/6SYUlzksci1FFkYqYKSo6PTzovRrjsXLP5i9u22bWq3
/SeSTWH7nRfBuciVJreSKx1p9otiFyyNykyTMTk66VcLt7JkODWsp66iTOHc
ccXlSsgbFiU8n8M0UML4o+Tajk/M+KwoWO4oXsJG+FzwJTmLNajnRynPGPqG
5Vo1pvJoydxQyHljhI+w7EaaLQu3aD+OGCTesP+WTOnw55LJx6mWoEeXJlzi
Mu0B6eH3z/jx+4hicQn2PhITHhStmDaqi9lnEK+YvGMyPJcM3DeZfWax7tJp
LHmBPgqvgHD6qEB/u2Y0UloabWE7VWBlrMmNEPo60guSSgGuS5Y8//QOYkLu
F0wy8gGMGR/SA+KC3qWG5IOxkRzQQ+oUAxdvU+rsYnLxUwhRzZmJjFEF6MMJ
hI9AEDMeR9owr4mGn+pn61xrAYiSavi0qBsIuEymzBoN5FaSt74PsvvD/kv0
KU+RXXg5uSJ6YaJu6M8zoTDmRs1qcMNUAbnJQkxEVvEjB4SOZvKUbqChtwsg
LFjMU84SUqCn7yNFcmFclvIlzGpBZoyUecIkakEg8BLSlWRiznNSgqWKJGIZ
wWCPtKVc5gmMWWYVBGuQcddlSXglMuB5+QDxVF30AUa616tMbdvaNnbNEsuM
3HMwQS+4ssYkgllrGEohkAVowWRq9VxVNIB6JTwNAqdt9y0Gt1KtT38NQ8ir
0Sk5Jj0ozHWCQZPgWXaACMKtzlGWiXsIADjWGOPdu0VtfMLfZFZVzZhAbi67
KP+KsyxRXerXaK+31c6aQw9B77mmbEiuKh4pGNfIKZtFUuCKCeQeUYI8ihJ2
GPpFdMdIFMdQ55iQuEcCwnEJnCVTopQx28E/xuRq2DSmacqzoBGxEes/mQlT
7ifguqlFgdiggHgKcIJq23NwJ5j+/A5Rc2pR83sLlx/ZbIqBsFj5EZ8/2MMB
IBNHb8H/Dw4lAwAkYqB1XJsQXj4AzmvWBf7mzEADL2aODGCtIsBV+GDe3N/f
u+RDujBtJN4Fl0bfWkDsXO485x0HIV+AcTVT5GjUhUWTrTfsrtuQBrUJT4Z5
I/vfsVS3qFqsjoZOa/i4c9XsybvuGPXcEFveJi3RjgLEGpk/RYo5BHJSPYFJ
asxpnqBAk4BTFp/jsYkZouW5WBZdpMIK6ZMZsLI10HNHAJy1sSMf+kqUPsWh
AKAIIOgUYXUZ5dGcmc7n376cx5T8zWgBTkARVQUElfVbhHgO2E5s2G/3+h4E
ifh8UVvuXXpEGj6sPe7bHAQpx+LQMvDDfuXtaoYq/hsc7Y6LbaW2NTuRq67a
xnNEuY20hWR3nEH+IODRIa0AD39NZ/P8tsbsn6QTwwD5mAq/ZQ8aybsUjfvH
3394FeoHTft1Y+nwudkhYtEhoxBJzrIM1+2Er6PACLgAx0PXus6+52zCI9lw
d4gRQ9K5ztR6KwjOceoVWRF/mXCNU5vdWPWXLkAmUawIL9hlTufF80D2a35A
htGXRGTO7yATUXHSeZGWuU2cyhj0lDnuULEAVpiUcLxDkZWQoDmEqlP35uBg
N/J5vTKENPfkNW0KPmIR5kXgZ6yP/v++ubMVpSwkOXz81RNDJVQtGPx1DVjl
A5P7jczHrHXkb5jN2Ya/gko20oXXEfaGVm5nBWh2l2u/GnX3pAKWsPJvs8rO
FNaZXerWpdVfvwRaTodeUKtE29J81qCcSmizIq32YO2llGFeLmdwKpiW0Bho
FoPGzrqBCg6rzuVmK6xjUmZ6zIYHDYA/aOZiq+ExX5ukderG/CuknmyV2jgT
8NEXmamozot9vIQv9DI7xYnRAryFM5rrjJ2if00xCjka2ClYWzIdmfvumL65
/HB5c3Y7uaHEYdGYvuexFEqkcBeXMHcNqpKX4THFrcoUDMmifF7C/Jh+ju4i
O4nrFQAo6CqjPEGe3VQuIb6/g7bwFEb+aKHM6GXHyvgiXgges/GQvnbEqpwt
ue72YPzHOnfnRi8g2F3CyRYJDRlxlMcsixdgKVMNG+4iaYoGD+zXbjyR82s3
9EuYw8De4XZ4F2Ule22r1bRIQ1d7SBtmkdJmdpJ2DZy8tkXddaR7+NIEawQV
CJy0JgOwQtmT4rhv9/ReO2xYcclq+rV6mYYdq84J/qjT2mgRZUwCgpKzHKsR
MN1cpqTC1zJ4iTCFbDyxgHsvXDBKaKj65DpjePxBs61BKUNZSDGX0ZLAQZII
uWethz5MlzI3koN29JEz9hRbE8v1HEhnbHRBMCZuDMp6IowGNqkx5zOef4ET
KxtTpR8zphaMaehjHgvgqAHJBrFSlCwkS+0bM6UGegbIGeI8Mhi4ooTHmUge
cSoVculKENUEBSiBslyIZEwLoYC/NWe8nsOGJc+LUjsdFjxJWE4dO98pEGPd
mI72x093FPunhmPC7+BezOcgMgYYYJKejuyD1VxHMwjoTEg4f8b0BPCCZVkR
JYj6ZnzPE0yj4fHxPniDYcMJo5ewMpvHIhOw67sr80MdGz97bH5QC0JGWpq/
+JRs5nkybLL0m0fFmvopJBlZFZ1GUP/0TPIoAxKoGpHPT0cz7r6aiLnFc1VL
u386GpiN7tszG6Bg+KMTa9LA2bSDbcPhCWj1RCxW4nD8J3Go/XR+jP+oU6Cp
zCaFGkuwWBi3NKfwuvtjKwuxEnwO3g6b6YcJjvOQaARvGWP6EuM1KBpCGpp4
t7mB3FHjDSnRsuEpnxZfkyuAmNK8PlDrES/aMgdewACk72htm+LrotQKyKzU
Gm5pJIbTRY1hlPuYTPGVj0l0OEQNFPO8ZASRBt97uCBO6yOcEpHHGY+/jKmF
5db5ji8FQwS03opCu2lzbcuJYJ/hZfsSW5NbYX9T6LdOpebSczzqdNXCHoLu
uF3x63s/u8W1vrnZ7N0d9XojyCyKv6AqRrv3bVVsj7OuQrv32aLBnzg3CMx/
DQVBAjeySaFvTJ8LY9Jp3EPqO/JGqLXNsb1cB4Ghowowr+KHx72xDL0KN+LS
vMhMyyx7pK1Nw5VNv+QGR8Ex6O9Gx2L7Ey0fSTSPeL7XYlOssjGyXbY2pLd2
YdfU3kU+iBxyveNvFKq6yO/vhHDQLj3+VfDmtBQpqYGO/EgAxysT9jecdd8A
+ewAHjEy1ajF6Hln6jc9UT3XVz+82vUwrfe8+uembujOaaZFQb2W0BPCjcpz
bPgN2cNRG8G1k0hxr0DDY1/P+sHcn/Eul8HCv/CYteevf9GEofPbvxo3/4rQ
bDi2w1VWtdy1vML8k0vz4FvrgbsM/w9QSwECFAAUAAAACAAKbG4sOAWHhbUG
AAAMHQAAEQAAAAAAAAABACAAtoEAAAAAZm9sZGVyYWN0aW9ucy5hc3BQSwEC
FAAUAAAACAAPbG4snInxw+YJAABBHwAADwAAAAAAAAABACAAtoHkBgAAZmls
ZV9lZGl0b3IuYXNwUEsFBgAAAAACAAIAfAAAAPcQAAAAAA==
--0-1224384856-1016491454=:63792--
TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2025 AOH