Title Back Colour Keyoti Title Line Title Curve
Blue Box Top

CallbackHandler Vulnerability - SearchUnit - Forum

Welcome Guest Search | Active Topics | Log In | Register

Options
ajr
#1 Posted : Sunday, March 15, 2020 11:06:54 AM
Rank: Newbie

Groups: Registered

Joined: 3/15/2020
Posts: 4
Hi,
There is a vulnerability in callbackhandler.ashx
if we change the id parameter which is the index folder
the handler returns an exception and exposes physical address of the site
is there any work around for this problem?
thanks
Jim
#2 Posted : Monday, March 16, 2020 10:14:43 PM
Rank: Advanced Member

Groups: Administrators, Registered

Joined: 8/13/2004
Posts: 2,610
Location: Canada
Hi, thanks for reporting it, for others info this only affects Server Control usage, not the new Javascript based usage.

If you have a v7 license then please update to

https://www.dropbox.com/.../SU-ASHX-Patch.zip?dl=0

Otherwise you can potentially filter responses like this

https://weblog.west-wind...put-with-responsefilter

Jim
-your feedback is helpful to other users, thank you!


ajr
#3 Posted : Tuesday, March 17, 2020 7:26:37 AM
Rank: Newbie

Groups: Registered

Joined: 3/15/2020
Posts: 4
Hi, Thanks for your reply.
I Updated the dlls but the problem is still there
If I change the id parameter of the callback handler, it returns an exception and reveals the physical address.
I think you should not reflect exception to the output at all.
have I done something wrong?
thanks for your reply.
Jim
#4 Posted : Tuesday, March 17, 2020 6:29:22 PM
Rank: Advanced Member

Groups: Administrators, Registered

Joined: 8/13/2004
Posts: 2,610
Location: Canada
I agree with you. I think that you might need to update the references in your web.config to the new version.

Eg you might have this in at least 2 places

type="Keyoti.SearchEngine.Web.CallBackHandler, Keyoti4.SearchEngine.Web, Version=2017.7.x.x, Culture=neutral, PublicKeyToken=58d9fd2e9ec4dc0e"

where 'x' is specific to your version. You need to update to the new version which is 2017.7.20.316 (otherwise it keeps using the old version from your GAC).

Sorry I didn't foresee that.

Jim
-your feedback is helpful to other users, thank you!


ajr
#5 Posted : Thursday, March 19, 2020 1:38:40 PM
Rank: Newbie

Groups: Registered

Joined: 3/15/2020
Posts: 4
Thanks again for your reply.

I updated web.config as you said. now the error message is changed. but still the directory is exposed!

now it outputs two exceptions that in my opinion the second should not be there. Here are the exceptions:

~Exception/Sorry the index directory path is not valid please check AutoCompleteQueryIndexDirectory or Keyoti-SearchEngine-IndexDirectory in the web.config
~Exception/Directory holding D:\xxx\App_Data\SiteSearch\Search_Index1\configuration.xml does not exist and needs to be created first.


Thanks and best regards
Amir
Jim
#6 Posted : Thursday, March 19, 2020 8:35:35 PM
Rank: Advanced Member

Groups: Administrators, Registered

Joined: 8/13/2004
Posts: 2,610
Location: Canada
Sorry, not sure how I missed that, please update to this version 2017.7.20.319

https://www.dropbox.com/...p/SU-ASHX-Patch.zip?dl=2
-your feedback is helpful to other users, thank you!


ajr
#7 Posted : Friday, March 20, 2020 7:55:33 AM
Rank: Newbie

Groups: Registered

Joined: 3/15/2020
Posts: 4
Thank you
It solved the problem
regards
Forum Jump  
You cannot post new topics in this forum.
You cannot reply to topics in this forum.
You cannot delete your posts in this forum.
You cannot edit your posts in this forum.
You cannot create polls in this forum.
You cannot vote in polls in this forum.




About | Contact | Site Map | Privacy Policy

Copyright © 2002- Keyoti Inc.