QuiXplorer directory traversal

[Cyrille Barthelemy <cb-lse () ifrance com>]

Title:  QuiXplorer directory traversal
Affects:
        <= QuiXplorer 2.3
Effect: file disclosure, web server's user read access
Id: cbsa-0003
Release Date: 2004 08 14
Author: Cyrille Barthelemy <cb-publicbox () ifrance com>


-- 1. Introduction
------------------
From QuiXplorer documentation :

"QuiXplorer is a simple, but fully functional, file manager for websites.
QuiXplorer allows you to browse the files & directories on your webserver
(with PHP4). (without using an external FTP-client)"


-- 2. Problem
-------------
QuiXplorer does not apply filters on user inputs when a download is 
requested.
The directory parameter is well filtered to check that it does not 
create a request
that goes outside the authorized directories, but the item can contains 
parent directory
references.
As quixplorer does not make the request ing the web server features, any 
file on the
server can be obtained (according to jail or chroot).


-- 3. Solution
--------------
Apply the given attached patch against the QuiXplorer 2.3 sources or 
download the
latest version (2.3.1) from the web site.


-- 4. References
----------------
  - QuiXplorer web site
        http://quixplorer.sourceforge.net/


-- 5. History
-------------
2004-08-12
        - Vulnerability discovered
2004-08-12
        - Vulnerability reported to quixproject at users.sourceforge.net
        - Vendor response, new version available
2004-08-14
        - Release

        
-- 6. Patch
-----------
------------8<-------------

--- quixplorer_2_3.orig/.include/fun_down.php	2003-04-25 
22:15:28.000000000 +0200
+++ quixplorer_2_3/.include/fun_down.php        2004-08-12 14:23:46.551569904 +0200
@@ -39,6 +39,7 @@

------------------------------------------------------------------------------*/

//------------------------------------------------------------------------------
 function download_item($dir, $item) {          // download file
+       $item=basename($item);
 	if(($GLOBALS["permissions"]&01)!=01) 
show_error($GLOBALS["error_msg"]["accessfunc"]);
 	if(!get_is_file($dir,$item)) show_error($item.": 
".$GLOBALS["error_msg"]["fileexist"]);
 	if(!get_show_item($dir, $item)) show_error($item.": 
".$GLOBALS["error_msg"]["accessfile"]);

------------8<-------------


--
Cyrille Barthelemy
Epita SRS
http://www.cyrille-barthelemy.com
http://www.vnet-project.org