Directory Traversal in DevExpress ASP.NET File Manager

During a penetration test RedTeam Pentesting discovered a directory traversal vulnerability in DevExpress’ ASP.NET File Manager and File Upload. Attackers are able to read arbitrary files by specifying a relative path.

Details

• Product: DevExpress ASPxFileManager Control for WebForms and MVC
• Affected Versions: DevExpress ASPxFileManager v10.2 to v13.2.8
• Fixed Versions: DevExpress ASPxFileManager v13.2.9
• Vulnerability Type: Directory Traversal
• Security Risk: high
• Vendor URL:
• https://www.devexpress.com/Products/NET/Controls/ASP/File-Upload-Explorer/
• Vendor Status: fixed version released
• Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2014-006
• Advisory Status: published
• CVE: CVE-2014-2575
• CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2575

Introduction

“The DevExpress ASP.NET Subscription includes a standalone Multi-File Upload Manager for WebForms and MVC and a pre-built File Manager for WebForms; built so you can instantly introduce file management capabilities in your next web application.”

(from DevExpress’ Homepage)

More Details

The ASPX File Manager component is prone to a directory traversal vulnerability. Attackers with access to the File Manager component can read arbitrary files on the same partition as the shared directory.

A common request to download a file via the File Manager component requires multiple HTTP-Post parameters:

The parameter __EVENTARGUMENT=13|<file.ext> specifies a file download and the file which is to be downloaded. Attackers may also request files outside of the shared directory by prepending a relative path to a parent directory.

Proof of Concept

By requesting files with a relative path, files otherwise not available will be accessible through the File Manager component. Depending on the shared directory and the webserver configuration, the webserver configuration file might for example be accessible through the File Manager component:

Other sensitive operating system files could be affected, too.

Example exploit: .. code:

curl --data __EVENTTARGET=ctl00%24ContentPlaceHolder1%24ASPxFileManager1\
"&__EVENTARGUMENT=13%7C../../web.config&=&__EVENTVALID" \
http://example.com/FileManagerComponent.aspx

The request above will download the specified file.

Workaround

Instead of a physical file system provider, a database file system provider with limited access permissions could be used.

Fix

Update ASPxFileManager control to DevExpress libraries version v13.2.9.

Security Risk

The risk is estimated to be high. This vulnerability allows attackers to access arbitrary files on the same partition as the File Manager’s root directory. This may allow attackers to read sensitive information like the webserver configuration.

Timeline

• 2014-03-10 Vulnerability identified
• 2014-03-21 Customer approved disclosure to vendor
• 2014-03-21 CVE number requested and assigned
• 2014-03-25 Vendor notified
• 2014-04-11 Customer opened support ticket with vendor
• 2014-04-17 Vendor released fixed version
• 2014-04-17 Vendor released security advisory to customers
• 2014-06-05 Advisory released

References

Vendor Security Advisory: http://security.devexpress.com/de7c4756/?id=ff8c1703126f4717993ac3608a65a2e2

RedTeam Pentesting GmbH

RedTeam Pentesting offers individual penetration tests, short pentests, performed by a team of specialised IT-security experts. Hereby, security weaknesses in company networks or products are uncovered and can be fixed immediately.

As there are only few experts in this field, RedTeam Pentesting wants to share its knowledge and enhance the public knowledge with research in security-related areas. The results are made available as public security advisories.

More information about RedTeam Pentesting can be found at https://www.redteam-pentesting.de.