Arbitrary remote file creation in 123flashchat server
Remote arbitrary file creation vulnerability on the 123 Flash Chat server via user registration.
Antecedentes
123 Flash Chat is a Java chat server with a Flash client. It has a user registration form enabled by default, so anyone can create a chat account.
Description
The username field in the registration form does not filter directory traversal sequences (../). Upon registration, the server creates a user file in the members directory, so an attacker can choose the path and name of the file created on the system, with the same privileges as the server.
Business impact
The chat service may become unavailable or be remotely compromised.
Affected systems
123 Flash Chat Server up to version 5.1 (released on December 22, 2005). Tested on versions 5.1 and 5.0.
Solución
The manufacturer released version 5.1_2, which fixes the vulnerability.
Calendario de divulgación
References
The information contained within this advisory is supplied 'as-is' with no warranties or guarantees of fitness for use or otherwise. Internet Security Auditors accepts no responsibility for any damage caused by the use or misuse of this information.
Company based in Spain and Colombia, specializing in web application auditing, network security, penetration testing, and compliance implementation and assessment. Our clients include some of the largest finance, telecommunications, insurance, and ICT companies. A vendor-independent provider with in-depth experience since 2001. Our R&D efforts include vulnerability research, collaboration on open security projects, whitepapers, and participation in industry events.
Would you like us to review your product?
Contact usDo you need a security audit?
Tell us about your situation and our team will get in touch with you to provide guidance or schedule a technical call.
Request information
Our offices
Transversal 22 # 98-82, Porta 100 Building, Office 1003
110221 Bogotá (Colombia)