Overview
A vulnerability in DOMIT! RSS allows an attacker to read local files.
Description
DOMIT! RSS is an RSS parser for PHP. DOMIT! RSS includes a test script called testing_domitrss.php. This script writes out the contents of any user-supplied URL to a local file named the MD5 hash of the URL (e.g., md5 -s [string]). The script doesn't validate the user-supplied URL, so an attacker can provide any string as input, such as a local file (e.g., /etc/passwd) and predictably know the name of the file to access it. DOMIT! RSS Parser is included as a component in other software packages, notably trixbox and SugarCRM. Reports indicate scanning activity for vulnerable trixbox installations. |
Impact
An unauthenticated remote attacker could read any file accessible to the user executing testing_domitrss.php (typically the web server process). |
Solution
Remove testing_domitrss.php |
Vendor Information
Any software that uses DOMIT! RSS may be affected, not only trixbox and SugarCRM. |
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| Temporal | 6.2 | E:F/RL:OF/RC:C |
| Environmental | 1.6 | CDP:ND/TD:L/CR:ND/IR:ND/AR:ND |
References
Acknowledgements
This document was written by Art Manion.
Other Information
| CVE IDs: | None |
| Date Public: | 2009-02-04 |
| Date First Published: | 2013-01-11 |
| Date Last Updated: | 2013-01-11 23:43 UTC |
| Document Revision: | 19 |