← Advisories

Gemalto Sentinel License Manager 18.0.1 Directory Traversal Vulnerability

Medium
Advisory ID
ZSL-2016-5330
Release Date
16 June 2016
Vendor
Affected Version
18.0.1.55505
CVE
N/A
Tested On
Microsoft Windows 7 Ultimate SP1 (EN), HASP LM/18.00 (web server)
Summary

The Sentinel License Manager enforces and manages licensing in multi-user environment. It keeps track of all the licenses and handles requests from network users who want to run your application, granting authorization to the requesters to allow them to run the application, and denying requests when all licenses are in use. It is an integral component of the network licensing schemes that can be implemented with Sentinel RMS, namely server-locked licenses, site licenses and commuter licenses.

Description

Input passed via the 'alpremove' and 'check_in_file' parameters is not properly verified in '/_int_/action.html' and '/_int_/checkin_file.html' before being used to delete and create files. This can be exploited to arbitrarily delete sensitive information on a system and/or write files via directory traversal attacks.

Proof of Concept
Disclosure Timeline
N/A
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
16.06.2016Initial release
18.06.2016Added reference [2] and [3]
21.06.2016Added reference [4]