The given example http://10.0.25.5/lcgi/sewse.nlm?sys:/novonyx/suitespot/docs/sewse/viewcode.jse+httplist+httplist/../../../../../system/autoexec.ncf results in "Cannot read from insecure path." according to viewcode.jse code fragment: // only read file which is under the secure sewse path -- hence filtering ".." if ((argv[i]).indexOf("..") != -1) { return "Cannot read from insecure path."; } System: NW5.1sp3 sys:/novonyx/suitespot/docs/sewse/viewcode.jse of 03/12/01. Workarounds: ~~~~~~~~~~~~ Apply service pack, latest version out since 5 months! Greetings E.N. -- --------------------------------------------------------- Eberhard Nowak, JWG-Universitaet, Hochschulrechenzentrum Grueneburgplatz 1, 60629 Frankfurt, Germany Phone : +49 69 798-33198 Fax: +49 69 798-28313 E-mail: nowak@rz.uni-frankfurt.de >>> IRM Security Advisories<advisories@irmplc.com> 19.12.2001 12:44 >>> >demonstrate the flexibility and features of the product. However, one >sample page uses a Netware Loadable Module (NLM) called sewse.nlm to >call a script called viewcode.jse. The viewcode.jse file is designed to >be used to display the source code of sample files called httplist.htm >and httplist.jse. These file names are passed as parameters to the NLM >through a URL such as (URL may wrap): > >http://10.0.25.5/lcgi/sewse.nlm?sys:/novonyx/suitespot/docs/sewse/viewcode.jse+httplist/httplist.htm+httplist/httplist.jse > >The application checks the files being requested by requiring that the >httplist directory is specified in the path to the files to be viewed. >However, it is possible to traverse directories using /../ after >httplist. The sewse.nlm module runs with sufficient permissions whereby >it possible to traverse to any file on the file system and view the contents. >There are many files that may be of interest to an attacker and these >include:[...] > >Workarounds: >~~~~~~~~~~~~ >A workaround involves removing all sample web pages and sample NLMs.[...]
