OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq Archives: Re: Groupewise Web Interface

Re: Groupewise Web Interface

Subject: Re: Groupewise Web Interface
From: Tim Adams (tadamsIWPSD.ORG)
Date: Tue Dec 21 1999 - 12:06:30 CST

I'm running GroupWise 5.5 (w/ the Enhancement Pack). On our web server if I use the following URLS:

http:// address>/cgi-bin/GW5/GWWEB.EXE?HELP=../../../../../index.htm
http:// address>/cgi-bin/GW5/GWWEB.EXE?HELP=bad-request.htm
     (or html, or no extension at all)

I get a "Not Found The requested object does not exist on this server. The link you followed is either outdated, inaccurate, or the server has been instructed not to let you have it. "

If I modify the "Help" link on the login page (http:// address>/com/novell/webaccess/help/en/bad.htm), I still get the "Not Found" message.

Here's the interesting bit: Modify the URL by removing the *.html file. Now you can browse the directory structure of the web server. Go to the /com/novell/webaccess directory and what do we find? The webacc.cfg file. The file actually contains the version of the server, Novell paths, etc. No passwords are contained here. The actual gateway password is stored encrypted in the commgr.cfg file (which is stored in a location separate from the actual web pages/servlets).

You can't get to the NDS structure from the website (according to Novell). Best solution here (if you are still concerned) is to insure that the NDS tree isn't duplicated onto this server, and place it outside of your firewall. The box itself contains no user information (please don't say you are running the Web access from your main GroupWise box) - it just passes the login to the GroupWise server.

Possible solutions:

1) Modify the html code, removing the "Help" button and links.
2) Add an index.htm file to each level of the open directory structure that will redirect the user back to the login page - or add a "honey pot" to track unauthorized users

I've forwarded this message off to my Novell rep. More solutions should be forthcoming.

Tim Adams

>>> Sacha Faust Bourque <sfaustHARTCO.COM> 12/19/99 03:08PM >>>
Problems found with GroupeWise web server ( Novell was contacted 3 weeks ago
and no reply )
-----------------------------------------------------------------

1. The help argument in GWWEB.EXE reveal full web path on the server
2. anyone can read a .htm file on the system with the GWWEB.EXE and the HELP
argument.

Example:

1. ( full web server path )

By sending http://server/cgi-bin/GW5/GWWEB.EXE?HELP=bad-request
the server will reply
Could not find file SYS:WEB\CGI-BIN\GW5\US\HTML3\HELP\BAD-REQUEST.HTM
2. ( read any .htm file )

by sending http://server/cgi-bin/GW5/GWWEB.EXE?HELP=../../../../../index (
refering to the path returned in the previous example ). You will see the
main web site interface.

We did some intensive test with the HELP trying to get rid of the .htm that
it happens and we were unable to
get rid of it. We are currently testing other arguments sent to GWWEB.EXE.

This was tested on GroupWise 5.2 and 5.5 .

This was found by Laurent Hollo and me.

Sacha Faust Bourque
sfausthartco.com

This archive was generated by hypermail 2b27 : Tue Dec 21 1999 - 15:08:26 CST