'probe.cgi' Input Validation Hole in 'olddat' Parameter Lets Remote Users Execute Arbitrary Commands
|
|
SecurityTracker Alert ID: 1014393 |
|
SecurityTracker URL: http://securitytracker.com/id/1014393
|
|
CVE Reference:
CVE-2005-2178
(Links to External Site)
|
Updated: Jun 24 2008
|
Original Entry Date: Jul 5 2005
|
Impact:
Execution of arbitrary code via network, User access via network
|
Exploit Included: Yes
|
|
Description:
A vulnerability was reported in 'probe.cgi'. A remote user can execute arbitrary commands on the target system.
The script does not properly validate user-supplied input in the 'olddat' parameter. A remote user can supply a specially crafted parameter value to execute arbitrary commands on the target system. The commands will run with the privileges of the target web service.
A demonstration exploit URL is provided:
http://[target]/cgi-bin/probe.cgi?olddat=|id|
spher3 from BADROOT SECURITY GROUP reported this vulnerability.
|
Impact:
A remote user can execute arbitrary commands on the target system with the privileges of the target web service.
|
Solution:
No solution was available at the time of this entry.
|
Cause:
Input validation error
|
Underlying OS:
Linux (Any), UNIX (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 05 Jul 2005 22:17:54 +0000
Subject: [badroot security] probe.cgi: Remote Command Execution
|
___________________________________________________________
BADROOT SECURITY GROUP
Security Advisory 2005 - #0x06
http://www.badroot.org
irc.us.azzurra.org ~ #badroot
___________________________________________________________
Authors ....... spher3 (spher3 at fatalimpulse dot net) Date
.......... 04-07-2005
Product ....... probe.cgi
Type .......... Remote Command Execution
o Info:
================
That script is used to open file '.dat'.
o Vulnerable Code:
================
..
23 [...]
24 $old = $query->param('olddat');
25 [...]
..
..
34 [...]
35 open (VF, "$olddat");
36 [...]
..
(24) At this line, the cgi param 'olddat' is associated to one database.
This variable isn't checked by anyone matching, so you can open
all file that you want. (35) At this line the script open the file
that you had chosen. With pipe `|`
is possible to execute arbitrary code on the shell.
o Proof of concept:
================
http://the-vuln.site.org/cgi-bin/probe.cgi?olddat=|id|
uid=99(www) gid=99(www)
Original ADV: http://www.badroot.org/advisories/SA0x06
|
|
