Path traversal in Cobbler

1) Path traversal

EUVDB-ID: #VU41683

Risk: Low

CVSSv4.0: 2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2014-3225

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: Yes

Description

The vulnerability allows a remote #AU# to gain access to sensitive information.

Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Cobbler: 2.4.0 - 2.6.0

CPE2.3

• cpe:2.3:a:cobbler_project:cobbler:2.4.0:*:*:*:*:*:*:*
• cpe:2.3:a:cobbler_project:cobbler:2.4.1:*:*:*:*:*:*:*
• cpe:2.3:a:cobbler_project:cobbler:2.4.2:*:*:*:*:*:*:*

External links

https://packetstormsecurity.com/files/126553/Cobbler-Local-File-Inclusion.html
https://seclists.org/oss-sec/2014/q2/273
https://seclists.org/oss-sec/2014/q2/274
https://www.exploit-db.com/exploits/33252
https://www.osvdb.org/106759
https://www.securityfocus.com/archive/1/532094/100/0/threaded
https://www.securityfocus.com/bid/67277
https://github.com/cobbler/cobbler/issues/939
https://www.youtube.com/watch?v=vuBaoQUFEYQ&feature=youtu.be

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.