Directory traversal vulnerability in Advantech WebAccess before 8.1 allows remote attackers to list arbitrary virtual-directory files via unspecified vectors.

The installed version of Advantech WebAccess is 8.x prior to 8.1 and is affected by the following vulnerabilities :

 - Multiple overflow conditions exist in 'BwpAlarm.dll' that are triggered as user-supplied input is not properly validated when handling various IOCTL system calls. With a specially crafted request to the webvrpcs service, a remote attacker can cause a stack-based buffer overflow, resulting in a crash or potentially allowing the execution of arbitrary code.
 - An overflow condition exists in 'WaDBS.dll' that is triggered as user-supplied input is not properly validated when handling IOCTL 0x13C7C and the 'TagName' parameter. With a specially crafted request to the webvrpcs service, a remote attacker can cause a stack-based buffer overflow, resulting in a crash or potentially allowing the execution of arbitrary code.
 - An overflow condition exists in 'BwBASScdDl.dll' that is triggered as user-supplied input is not properly validated when handling IOCTL 0x138B4 and the 'TargetHost' parameter. With a specially crafted request to the webvrpcs service, a remote attacker can cause a stack-based buffer overflow, resulting in a crash or potentially allowing the execution of arbitrary code.
 - An overflow condition exists in 'BwOpcSvc.dll' that is triggered as user-supplied input is not properly validated when handling IOCTL 0x13895 and the 'WindowName' parameter. With a specially crafted request to the webvrpcs service, a remote attacker can cause a stack-based buffer overflow, resulting in a crash or potentially allowing the execution of arbitrary code.
 - Multiple overflow conditions exist in 'BwKrlApi.dll' that are triggered as user-supplied input is not properly validated when handling various IOCTL system calls. With a specially crafted request to the webvrpcs service, a remote attacker can cause a stack-based buffer overflow, resulting in a crash or potentially allowing the execution of arbitrary code.
 - Multiple overflow conditions exist in 'ViewSrv.dll' that are triggered as user-supplied input is not properly validated when handling various IOCTL system calls. With a specially crafted request to the webvrpcs service, a remote attacker can cause a stack-based buffer overflow, resulting in a crash or potentially allowing the execution of arbitrary code.
 - Multiple overflow conditions exist in 'DrawSrv.dll' that are triggered as user-supplied input is not properly validated when handling various IOCTL system calls. With a specially crafted request to the webvrpcs service, a remote attacker can cause a stack-based buffer overflow, resulting in a crash or potentially allowing the execution of arbitrary code.
 - An overflow condition exists in 'ViewDll.dll' that is triggered as user-supplied input is not properly validated when handling IOCTL 0x280B. With a specially crafted request to the webvrpcs service, a remote attacker can cause a stack-based buffer overflow, resulting in a crash or potentially allowing the execution of arbitrary code. 
 - Multiple overflow conditions exist in 'datacore.exe' that are triggered as user-supplied input is not properly validated when handling various IOCTL system calls. With a specially crafted request to the datacore service, a remote attacker can cause a stack-based buffer overflow, resulting in a crash or potentially allowing the execution of arbitrary code. 
 - A flaw exists that is triggered as file types and extensions for uploaded files are not properly validated by the Dashboard Viewer 'UploadAjaxAction' script before being placed in a user-accessible path. This may allow a remote attacker to upload e.g. an arbitrary file and then request it in order to execute arbitrary code with SYSTEM privileges.
 - A flaw exists that is triggered as file types and extensions for uploaded files are not properly validated by the Dashboard Viewer 'SaveGeneralFile' script before being placed in a user-accessible path. This may allow a remote attacker to upload e.g. an arbitrary file and then request it in order to execute arbitrary code with SYSTEM privileges.
 - A flaw exists in Dashboard Viewer that allows traversing outside of a restricted path. The issue is due to the 'removeFolder' script not properly sanitizing user input, specifically path traversal style attacks (e.g. '../'). With a specially crafted request, a remote attacker can delete, rename, overwrite, and read arbitrary directories on the system.

The Advantech WebAccess application running on the remote host is prior to version 8.1-2015.12.30. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists due to     the storage of email project accounts in plaintext. A     remote attacker can exploit this to disclose sensitive     information about email project accounts.
    (CVE-2015-3943)

  - A cross-site request forgery vulnerability exists due to     a failure to require multiple steps, explicit     confirmation, or a unique token when performing     sensitive actions. A remote attacker can exploit this,     by convincing a user to follow a specially crafted link,     to hijack the authentication of users. (CVE-2015-3946)

  - A SQL injection vulnerability exists due to improper     sanitization of user-supplied input before using it in     SQL queries. A remote, authenticated attacker can     exploit this to inject or manipulate SQL queries to the     back-end database, resulting in the manipulation or     disclosure of arbitrary data. (CVE-2015-3947)

  - A cross-site scripting vulnerability exists due to     improper validation of input before returning it to     users. A remote, authenticated attacker can exploit     this, via a specially crafted request, to execute     arbitrary script code in a user's browser session.
    (CVE-2015-3948)

  - A remote code execution vulnerability exists in the     browser plugin due to improper sanitization of input to     file names and paths. A remote attacker can exploit this     to execute arbitrary code. (CVE-2015-6467)

  - A remote code execution vulnerability exists due to a     format string flaw in BwOpcSvc.dll that is triggered as     format string specifiers (e.g. %s and %x) are not     properly provided when handling IOCTL 0x13881. A remote     attacker can exploit this, via a specially crafted     request to the  webvrpcs service, to execute arbitrary     code. (CVE-2016-0851)

  - An unspecified flaw exists due to improper access     control. A remote attacker can exploit this to gain     access to arbitrary files and folders. (CVE-2016-0852)

  - An information disclosure vulnerability exists due to an     unspecified input validation flaw. A remote attacker can     exploit this to disclose sensitive information.
    (CVE-2016-0853)

  - Multiple remote code execution vulnerabilities exist due     to improper validation of file types and extensions by     the UploadAjaxAction, SaveGeneralFile, and FileUpload     scripts. A remote attacker can exploit these issues to     upload arbitrary files and execute them with SYSTEM     privileges. (CVE-2016-0854)   
  - Multiple path traversal and file overwrite     vulnerabilities exist in the Dashboard Viewer due to     improper sanitization of user-supplied input in the     renameFolder, addFolder, removeFolder, removeFile, and     openWidget scripts. A remote attacker can exploit these     issues, via a specially crafted request, to rename or     overwrite arbitrary files and folders. (CVE-2016-0855)

  - Multiple remote code execution vulnerabilities exist due     to improper validation of user-supplied input when     handling IOCTL calls. A remote attacker can exploit     these issues, via a specially crafted request to the     webvrpcs or datacore service, to cause a stack-based     buffer overflow, resulting in a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-0856)

  - Multiple remote code execution vulnerabilities exist due     to improper validation of user-supplied input when     handling IOCTL calls. A remote attacker can exploit     these issues, via a specially crafted request to the     webvrpcs or datacore service, to cause a heap-based     buffer overflow, resulting in a denial of service     condition or the execution of arbitrary code.     (CVE-2016-0857)

  - A remote code execution vulnerability exists due to     improper validation of user-supplied input when handling     IOCTL 0x7920. A remote attacker can exploit this, via a     specially crafted request to the datacore service, to     cause a stack-based buffer overflow, resulting in a     denial of service condition or the execution of     arbitrary code. (CVE-2016-0858)

  - A remote code execution vulnerability exists due to     improper validation of user-supplied input when handling     IOCTL 0x791E. A remote attacker can exploit this, via a     specially crafted request to the datacore service, to     cause an integer overflow condition, resulting in a     denial of service condition or the execution of     arbitrary code. (CVE-2016-0859)

  - Multiple remote code execution vulnerabilities exist due     to improper validation of user-supplied input when     handling IOCTL 0x11172 and 0x11173. A remote attacker     can exploit these issues, via a specially crafted     request to the webvrpcs service, to cause a buffer     overflow, resulting in a denial of service condition or     the execution of arbitrary code. (CVE-2016-0860)

The Advantech WebAccess web server running on the remote host is affected by a file disclosure vulnerability in the WebAccess Dashboard Viewer due to a failure to properly sanitize user-supplied input to the openWidget script. An unauthenticated, remote attacker can exploit this, via path traversal, to read the content of arbitrary files on the WebAccess server.

Note that this Advantech WebAccess web server is reportedly affected by other vulnerabilities as well; however, Nessus has not tested for these.

ID	Name	Product	Family	Severity
9862	Advantech WebAccess 8.x < 8.1 Multiple Vulnerabilities	Nessus Network Monitor	SCADA	critical
89111	Advantech WebAccess < 8.1-2015.12.30 Multiple Vulnerabilities	Nessus	SCADA	high
88839	Advantech WebAccess openWidget Script Path Traversal Remote File Disclosure	Nessus	SCADA	high

Detections

Analytics

CVE-2016-0855

high

Tenable Plugins

critical

high

high