Home page logo

bugtraq logo Bugtraq mailing list archives

R7-0036: FCKEditor.NET File Upload Code Execution
From: HD Moore <HD_Moore () rapid7 com>
Date: Mon, 30 Aug 2010 11:55:36 -0400

R7-0036: FCKEditor.NET File Upload Code Execution
August 30, 2010

-- Vulnerability Details:

FCKEditor contains a file renaming bug that allows remote code execution. Specifically, it is possible to upload ASP 
code via the ASP.NET connector  in FCKEditor. The vulnerability requires that the remote server be running IIS. This 
vulnerability has been confirmed on FCKEditor 2.5.1 and 2.6.6.
CVSS Vector: AV:R/AC:L/Au:NR/C:C/I:C/A:C

Browse to http://<ip>fckeditor/editor/filemanager/connectors/test.html and choose the ASP.NET connector. By uploading a 
file with the same name as an existing file, that includes an underscore followed by a dot, it is possible to bypass 
the file renaming mitigation in place. For instance, when uploading a file twice with the name:
The first file would be renamed
BUT the second file will be renamed
Due to the IIS semi-colon vulnerability (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4444) the server will 
remotely execute myfile_.asp;(1).txt when the second file is accessed.

-- Vendor Response:
A new version of the .NET connector has been released to address this issue, it can be found at the URL below.


-- Disclosure Timeline:
2010-08-17 - Vulnerability reported to the vendor via contact form
2010-08-17 - Vulnerability reported to the vendor via bug tracker
2010-08-19 - Vulnerability reported to the vendor via email
2010-08-27 - Vendor replied indicating a fix is in the works
2010-08-27 - Vendor schedules the fix for August 30th, 2010
2010-08-30 - Vendor releases version 2.6.4 to address the issue

-- Credit:
This vulnerability was discovered by Will Vandevanter of the Rapid7 professional services team during a customer 

-- About Rapid7 Security
Rapid7 provides vulnerability management, compliance and penetration testing solutions for Web application, network and 
database security. In addition to developing the NeXpose Vulnerability Management system, Rapid7 manages the Metasploit 
Project and is the primary sponsor of the
W3AF web assessment tool. 

Our vulnerability disclosure policy is available online at:


  By Date           By Thread  

Current thread:
  • R7-0036: FCKEditor.NET File Upload Code Execution HD Moore (Aug 30)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]