bugtraq - EMC Data Protection Advisor DPA Illuminator EJBInvokerServlet Remote Code Execution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201312101452.rBAEq3lT026724@sf01web3.securityfocus.com>
Date: Tue, 10 Dec 2013 14:52:03 GMT
From: nospam@...il.it
To: bugtraq@...urityfocus.com
Subject: EMC Data Protection Advisor DPA Illuminator EJBInvokerServlet
 Remote Code Execution

EMC Data Protection Advisor DPA Illuminator EJBInvokerServlet Remote Code Execution 

tested against: Microsoft Windows Server 2008 r2 sp1
                EMC Data Protection Advisor 5.8 sp5

vulnerability:
the "DPA Illuminator" service (DPA_Illuminator.exe) listening
on public port 8090 (tcp/http) and 8453 (tcp/https) is vulnerable.
It exposes the following servlet:

http://[host]:8090/invoker/EJBInvokerServlet
https://[host]:8453//invoker/EJBInvokerServlet

due to a bundled invoker.war
The result is remote code execution with NT AUTHORITY\SYSTEM
privileges.

proof of concept url:
http://retrogod.altervista.org/9sg_ejb.html

~rgod~