full-disclosure - [FD] CSV injection vulnerability in SolarWinds Serv-U FTP Server

Open Source and information security mailing list archives

Message-ID: <MEAPR01MB2983972A911CC0EA1E663C459B550@MEAPR01MB2983.ausprd01.prod.outlook.com>
Date: Thu, 12 Dec 2019 22:54:44 +0000
From: Richard Tan via Fulldisclosure <fulldisclosure@...lists.org>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] CSV injection vulnerability in SolarWinds Serv-U FTP Server

Issue:                  CSV injection vulnerability

CVE:                    CVE-2019-13181

Security researcher:    Richard Tan @ The Missing Link Security

Product name:           Serv-U FTP Server

Product version:        Tested on 15.1.7

Fixed in:               Serv-U 15.1.7 Hotfix 2

# Overview

The application allowed table entries to contain a string which could  be
evaluated by Excel as a Dynamic Data Exchange (DDE) macro.

Privileged users who has the appropriate rights to modify or create users
could insert values into user properties which is evaluated as macros if the
user list is exported as an Excel format.

Steps to reproduce (Proof of concept):

1)      Login as a user that has privileges to create or modify users.

2)      Create a new user and add the following payload into the
"description" field.  "=cmd|'/C calc.exe'!A0"

3)      Export the user list with a file name "CSVinjection.csv" on the
application server.

4)      On the application server, locate the file and execute it. Notice
that a warning sign could be prompted depending the Excel's security
settings. (If so click enable)

5)      Observe that the calculator tool is executed. This is a proof of
concept however an adversary could exploit this weakness to potentially gain
access to the application server (or from where ever the file is executed
from).

Download attachment "smime.p7s" of type "application/pkcs7-signature" (5001 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives