SB2014101301 - Directory traversal in Magmi plugin for Magento

Description

This security bulletin contains information about 1 security vulnerability.

1) Directory traversal (CVE-ID: N/A)

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target sustem.

The weakness exists due to improper filtration of user-supplied input passed via the "file" HTTP GET parameter to  "/magmi-importer/web/download_file.php" script. A remote attacker can use directory traversal sequences (e.g. "../../") to view contents of arbitrary files on the target system. 

Exploitation example observed in the wild:

GET /…sanitized…/magmi-importer/web/download_file.php?file=../../app/etc/local.xml HTTP/1.1

Successful exploitation of the vulnerability results in disclosure of confidential and sensitive information from the root folder of the application. In case of Magento, the "/app/etc/local.xml" file contains credentials and encryption keys.

Note: the vulnerability was being actively exploited.

Remediation

Install update from vendor's website.

References

• https://github.com/dweeves/magmi-git
• https://www.trustwave.com/Resources/SpiderLabs-Blog/Zero-day-in-Magmi-database-client-for-popular-e-...