full-disclosure - Multiple vulnerabilities in WebMod 0.48

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20080503205150.8a620fda.aluigi@autistici.org>
Date: Sat, 3 May 2008 20:51:50 +0200
From: Luigi Auriemma <aluigi@...istici.org>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk,
	packet@...ketstormsecurity.org, cert@...t.org, news@...uriteam.com
Subject: Multiple vulnerabilities in WebMod 0.48

#######################################################################

                             Luigi Auriemma

Application:  WebMod
              http://www.djeyl.net/w.php
Versions:     <= 0.48
Platforms:    Windows and Linux
Bugs:         A] directory traversal
              B] Cookie buffer-overflow
              C] parser.cpp arbitrary memory writing
              D] scripts source disclosure
Exploitation: remote
Date:         03 May 2008
Author:       Luigi Auriemma
              e-mail: aluigi@...istici.org
              web:    aluigi.org

#######################################################################

1) Introduction
2) Bugs
3) The Code
4) Fix

#######################################################################

===============
1) Introduction
===============

WebMod is an open source MetaMod plugin which acts as a web server for
Half-Life running on the equivalent TCP port of the UDP one used by the
game.

#######################################################################

=======
2) Bugs
=======

----------------------
A] directory traversal
----------------------

WebMod uses an anti-directory traversal check which searchs for any
"../" pattern in the HTTP request of the client.
So it's enough to use a "..\" pattern to bypass the check and being
able to download any file from the disk where Half-Life is running
included the configuration files of the game server (like
..\..\..\..\platform\config\server.vdf or ..\..\..\server.cfg).
Note that this bug works only on Windows servers.

>>From server.cpp:

void clientHandle(int connfd, httpquery_t *query, int tid)
    ...
    if(strstr(str,"../")) // hack attempt, display index page
    {
        str[0]='\0';
    }

-------------------------
B] Cookie buffer-overflow
-------------------------

A cookie parameter longer than MYSOCK_BUFLEN (8192) bytes leads to a
stack based buffer-overflow.

>>From server.cpp:

void connectHandle(void *data)
{
char *input;
char buf[MYSOCK_BUFLEN+1];
            ...
            for(j=0;input[i]&&input[i]!=';'&&input[i]!='\n';j++,i++)
                buf[j]=input[i];

--------------------------------------
C] parser.cpp arbitrary memory writing
--------------------------------------

The functions in parser.cpp are affected by some memory corruption
vulnerabilities with different effects depending by the type of
variable/script used.
In short a value longer than MAX_FILE_SIZE (16384) bytes can lead to
the writing of custom data in a custom memory address through strcat
(auth.w?mode) or a NULL pointer (auth.w?redir) or an invalid memory
access (the rconpass parameter of auth.w) and so on.

----------------------------
D] scripts source disclosure
----------------------------

Adding a dot at the end of the requested URI allows the viewing of the
script source code instead of executing it.
This bug (which should work only on FAT/NTFS filesystems) can be
considered a security vulnerability ONLY if the server runs custom
scripts.

#######################################################################

===========
3) The Code
===========

http://aluigi.org/poc/webmodz.zip

  nc SERVER PORT -v -v < webmodz1.txt
  nc SERVER PORT -v -v < webmodz2.txt
  nc SERVER PORT -v -v < webmodz3.txt
  nc SERVER PORT -v -v < webmodz4.txt

#######################################################################

======
4) Fix
======

No fix

#######################################################################

--- 
Luigi Auriemma
http://aluigi.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/