I-Load is an ASP.NET component explicitly created to manage image uploading within ASP.NET applications. The I-Load component contains multiple vulnerabilities: Path Disclosure, Cross Site Scripting, File Disclosure and Arbitrary File Upload.
The I-Load component contains multiple vulnerabilities which are described below.
Path Disclosure:
The WebCoreModule.ashx script prints the absolute path of the folder name, where images are saved to, in some requests and responses. This can help an attacker with the exploitation of the also existing file disclosure vulnerability.
Cross Site Scripting:
Most of the parameters used by WebcodeModule.ashx start with two underscores "__" which disables the build-in ASP.NET "Anti Cross Site Scripting" functionality. Some parameters are not sufficiently validated and can be exploited to inject arbitrary JavaScript into the response.
File Disclosure:
WebCoreModule.ashx can be exploited by the means of path traversal to read arbitrary files on the server given that the file permissions allow it. An attacker is able to gain sensitive data such as configuration files (e.g. Web.config), the whole source code of the application or other sensitive data on the server.
Arbitrary File Upload:
It is potentially possible to upload an arbitrary file using the I-Load Webcontrol with a user-defined file extension. The filename itself is dynamically generated, but it is possible to reproduce that parameter in advance. The file remains on the server for a very short period of time. Nevertheless, during this time frame it could be possible to execute that file and thus compromise the affected server.
Proof of Concept:
SEC Consult will not release proof of concept exploits to the public.
Disclosure Timeline:
2009-09-01: Contacting RADactive.
2009-09-09: Reply from RADactive, vulnerabilities have been fixed and a new version has been released.
2009-09-17: Release of the advisory.
--------------------------------------------------------------------------------------------------------------------------------
Vulnerabilities like this exist in many sites. Find out how to eliminate XSS.
-
