October 22 2003

Directory Traversal Attacks on iWeb Web Server.

This is an advisory I did not bother posting to Bugtraq or Full disclosure
because its not a very widespread application. The following two directory
traversal attacks will work on iWeb mini http server 
(http://www.ashleybrown.co.uk/iweb/). The 'vendor' has been notified and
is quite aware of the problem. I actually received an email from her
saying these problems won't be fixed and that earlier versions suffered from
the same type of attacks. If you run this webserver as 'Administrator' then 
these attacks will be successful because administrator has permissions to these
directories and files.

http://127.0.0.1/..%5C..%5C..%5C..%5C..%5C..%5C/winnt/win.ini 
(or any text file in this dir)

http://127.0.0.1/..%5C..%5C..%5C..%5C..%5C..%5C/winnt/system32/registry.inf (or any text file in this dir)

Solution:
Windows 2000 and XP: 
Dont run iWeb as administrator, check permissions under winnt folders to make
sure your average users running this do not have permissions to those files.

Windows 95 and 98:
Don't use iWeb :)

chris@cr-secure.net
http://www.cr-secure.net