lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 12 Dec 2019 22:54:44 +0000
From: Richard Tan via Fulldisclosure <fulldisclosure@...lists.org>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] CSV injection vulnerability in SolarWinds Serv-U FTP Server

Issue:                  CSV injection vulnerability

CVE:                    CVE-2019-13181

Security researcher:    Richard Tan @ The Missing Link Security

Product name:           Serv-U FTP Server

Product version:        Tested on 15.1.7

Fixed in:               Serv-U 15.1.7 Hotfix 2

 

 

# Overview

The application allowed table entries to contain a string which could  be
evaluated by Excel as a Dynamic Data Exchange (DDE) macro.

Privileged users who has the appropriate rights to modify or create users
could insert values into user properties which is evaluated as macros if the
user list is exported as an Excel format.

 

Steps to reproduce (Proof of concept):

1)      Login as a user that has privileges to create or modify users.

2)      Create a new user and add the following payload into the
"description" field.  "=cmd|'/C calc.exe'!A0"

3)      Export the user list with a file name "CSVinjection.csv" on the
application server.

4)      On the application server, locate the file and execute it. Notice
that a warning sign could be prompted depending the Excel's security
settings. (If so click enable)

5)      Observe that the calculator tool is executed. This is a proof of
concept however an adversary could exploit this weakness to potentially gain
access to the application server (or from where ever the file is executed
from).

 


Download attachment "smime.p7s" of type "application/pkcs7-signature" (5001 bytes)


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists