NeoAxis Web Player Directory Traversal Vulnerability

Vulnerability Key Information Application Application Name: NeoAxis web player Official Website: http://www.neoaxis.com Affected Versions: <= 1.4 Platform: Windows Vulnerability Details Vulnerability Type: Directory Traversal Exploitation Method: Remote Report Date: January 15, 2012 Reporter: Luigi Auriemma Contact: a.luigi@autistici.org Personal Website: aluigi.org Introduction NeoAxis Engine is a versatile 3D engine designed for game development, simulation, and visualization system creation. The web player is a browser plugin used to run content online. Vulnerability Description When content is played through the plugin, the web content must be placed inside a ZIP file named , and a corresponding file must be created, containing the ZIP file's size and MD5 hash. When a browser accesses the page hosting the content, it first requests download and execution permissions. During the download phase, the ZIP file is stored in the "NeoAxis Web Player" user's Cache folder, and upon execution, all files are extracted into the ExtractedApplications folder. Due to the lack of filename validation during extraction, traditional directory traversal techniques can be exploited to write or overwrite files outside the ExtractedApplications folder. Exploit Code Place the file on a web server and load . Note that the default HTML file loads content from ; modify the URL accordingly to match your test server address. This proof-of-concept code will write a file named into the user's Startup folder. Remediation Advice Fix Status: No fix available

Goal Reached Thanks to every supporter — we hit 100%!

NeoAxis Web Player Directory Traversal Vulnerability