TX Text Control .NET Server For ASP.NET Arbitrary File Read / Write

Hej,

Let’s keep it short …

=====

Intro

=====

A “sudo make me a sandwich” security issue has been identified in the TX
Text

Control .NET Server for ASP.NET[1].

According to the vendor[2], “the most powerful, MS Word compatible document

editor that runs in all browsers”.

Likely all versions are affected however, it was not confirmed.

=====

Issue

=====

It was possible to change the configured system path for reading and writing

files in the underlying operating system with privileges of the user
running a

web application. This could be achieved by calling the setfiledirectory()

function exposed via JavaScript API[3].

===

PoC

===

— cut —

TXTextControl.setFileDirectory(0, “c:\\”)

— cut —

See also the attached image file for details.

===========

Remediation

===========

Contact the vendor[4] directly for remediation guidance.

========

Timeline

========

14.10.2024: Security contact requested from [email protected]
.

31.10.2024: CVE requested from MITRE.

……2024: Nobody cares.

12.11.2024: The advisory has been released.

==========

References

==========

[1]https://www.textcontrol.com/products/asp-dotnet/tx-text-control-dotnet-server/overview/

[2] https://www.textcontrol.com

[3]https://docs.textcontrol.com/textcontrol/asp-dotnet/ref.javascript.txtextcontrol.setfiledirectory.method.htm

[4] https://www.textcontrol.com/contact/email/general/

Cheers,

Filip Palian