CVE-2014-5393 Path Traversal to Sensitive Files in Webroot in "JobScheduler"

[Christian Schneider <mail@xxxxxxxxxxxxxxxxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


CVE-2014-5393
===================
"Path Traversal to Sensitive Files in Webroot" (CWE-219) vulnerability in 
"JobScheduler" product


Vendor
===================
Software- & Organisations-Service GmbH


Product
===================
"JobScheduler is a workload automation tool. It is used to launch JobScheduler 
objects, 
such as jobs and/or orders, at the occurrence of time, file or calendar events. 
JobScheduler 
was recognised in 2012 by Gartner Inc. with a placement in their Magic Quadrant 
for workload 
automation. JobScheduler provides solutions from simple to complex scheduling 
scenarios. 
It is available with an open source or a commercial licence."
 - source: 
http://www.sos-berlin.com/modules/cjaycontent/index.php?id=osource_scheduler_introduction_en.htm


Affected versions
===================
This vulnerability affects versions of JobScheduler prior to 1.7.4241 
as well as versions prior to 1.6.4246.


Patch
===================
The vendor has released patches for versions 1.7.x and 1.6.x at 
http://www.sos-berlin.com/modules/news/article.php?storyid=73
http://www.sos-berlin.com/modules/news/article.php?storyid=74


Reported by
===================
This issue was reported to the vendor by Christian Schneider (@cschneider4711) 
following a responsible disclosure process.


Severity
===================
High


Description
===================
Using specially crafted requests to access the web interface of JobScheduler it 
is possible 
as an underprivileged user ("info" permission) to list directories and read 
contents of 
(sensitive) files from the installation of the JobScheduler web interface, 
which includes 
datasource configurations (for example hibernate.cfg.xml and sos_settings.ini) 
as well 
as permission config files (scheduler.xml). These can include passwords, 
depending on 
which auth backend was defined. This can also be misused to escalate to the 
higher "all" 
permission from the lower "info" permission.


Proof of concept
===================
Due to the responsible disclosure process chosen and to not harm unpatched 
systems, 
no concrete exploit code will be presented in this advisory.


References
===================
http://www.sos-berlin.com/modules/news/article.php?storyid=73
http://www.sos-berlin.com/modules/news/article.php?storyid=74
http://www.christian-schneider.net/advisories/CVE-2014-5393.txt

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (Darwin)

iEYEARECAAYFAlQMj90ACgkQXYAsOfddvFM/UQCgvXLY95yZREDrIhvedQN30oKg
rEcAnR6qWeGTl4LKxpOj/JX+THE4gQ1+
=FhON
-----END PGP SIGNATURE-----