Exploit Icecast 1.1.x/1.3.x - Directory Traversal

[Exploiter]

EDB-ID

20972

Проверка EDB

1. Пройдено

Автор

GOLLUM

Тип уязвимости

REMOTE

Платформа

MULTIPLE

CVE

cve-2001-0784

Дата публикации

2001-06-26

source: https://www.securityfocus.com/bid/2932/info

Icecast is an open source audio-streaming server for both Unix and Microsoft Windows systems.

Icecast does not filter encoded characters from URLs when receiving web requests. If a remote attacker crafts a URL containing the ASCII equivalent of directory traversal characters, it is possible to escape Icecast's "root" directory. This will allow the attacker to view files readable by the ownership and group membership of the icecast server. 

Mp3-files residing outside the Web catalog can be accessed by replacing ascii-values for each ".", thus using "/%2E%2E/" instead of "/../" will walk one folder downward.

Place a mp3-file named "test1.mp3" in the directory below the one you specified in the variable "staticdir".

Then write the following in your browser:

http://localhost:8000/file/../test1.mp3 - Will fail in getting the file

http://localhost:8000/file/%2E%2E/test1.mp3 - Will succeed in getting the file