Digital Media Server Arbitrary File Access
Vendor: Keene Software
Product: Digital Media Server
Version: <= 1.0.2
Website: http://www.keenesoftware.com
BID: 11057
OSVDB: 8591 8592 8593
SECUNIA: 12272
PACKETSTORM: 34180
Description:
Keene Digital Media Server is an easy and affordable way to share all things digital with friends, family, and customers over your broadband connection. DMS turns your computer into a highly secure Web server that automatically converts your files and folders into Web pages, thumbnails, and media shows with no Web programming required. Integrated user and file access security management provide the ultimate control over your content.


Directory Traversal Vulnerability:
Not too long ago i saw there was a directory traversal vuln found in Keene Digital Media Server. it was fixed by the developers, but

http://localhost/%2E%2E%5Csystem.log

It seems that only ../ and %2E%2E/ were filtered out. If you hex encode the backslash or use a forward slash you can then traverse out of the web directory. For example I am able to grab the server log file with the above request.


Solution:
I contacted the developers but never received a response.


Credits:
James Bercegay of the GulfTech Security Research Team.