WebSVN 2.3.3 allows remote authenticated users to read arbitrary files via a symlink attack in a commit.

Thijs Kinkhorst reports :

James Clawson reported :

'Arbitrary files with a known path can be accessed in websvn by committing a symlink to a repository and then downloading the file (using the download link).

An attacker must have write access to the repo, and the download option must have been enabled in the websvn config file.'

James Clawson discovered that websvn, a web viewer for Subversion repositories, would follow symlinks in a repository when presenting a file for download. An attacker with repository write access could thereby access any file on disk readable by the user the webserver runs as.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2013-6892

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

James Clawson discovered that websvn, a web viewer for Subversion repositories, would follow symlinks in a repository when presenting a file for download. An attacker with repository write access could thereby access any file on disk readable by the user the webserver runs as.

ID	Name	Product	Family	Severity
89710	FreeBSD : websvn -- information disclosure (f69e1f09-e39b-11e5-9f77-5453ed2e2b49)	Nessus	FreeBSD Local Security Checks	low
82119	Debian DLA-136-1 : websvn security update	Nessus	Debian Local Security Checks	low
81218	Fedora 21 : websvn-2.3.3-8.fc21 (2015-1465)	Nessus	Fedora Local Security Checks	low
81217	Fedora 20 : websvn-2.3.3-8.fc20 (2015-1439)	Nessus	Fedora Local Security Checks	low
80972	Debian DSA-3137-1 : websvn - security update	Nessus	Debian Local Security Checks	low

Detections

Analytics

CVE-2013-6892

medium

Tenable Plugins

low

low

low

low

low