PerlDesk Language Variable Server-Side Script Execution Vulnerability
BID:11160
Info
PerlDesk Language Variable Server-Side Script Execution Vulnerability
| Bugtraq ID: | 11160 |
| Class: | Input Validation Error |
| CVE: |
CVE-2004-1678 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 13 2004 12:00AM |
| Updated: | Jul 12 2009 07:06AM |
| Credit: | Nikyt0x Argentina <[email protected]> disclosed this vulnerability. |
| Vulnerable: |
logicNow PerlDesk 0 |
| Not Vulnerable: | |
Discussion
PerlDesk Language Variable Server-Side Script Execution Vulnerability
It is reported that PerlDesk is susceptible to a server-side script execution vulnerability.
This vulnerability may be exploited to execute the contents of Perl scripts contained on the affected server filesystem. This will execute script code in the context of the affected CGI application, typically with the privileges of the web server process.
If a remote attacker does not have access to the affected server in a manner sufficient to place malicious a Perl script to exploit this vulnerability, they may still exploit it for information disclosure purposes. Error messages that will reportedly be displayed when PerlDesk attempts to include files requested by the attacker may contain potentially sensitive information. With sufficient knowledge of the affected system, an attacker may also cause other preexisting scripts to be executed that may also aid them in further attacks.
This vulnerability may aid the attacker in further application, or system attacks.
It is reported that PerlDesk is susceptible to a server-side script execution vulnerability.
This vulnerability may be exploited to execute the contents of Perl scripts contained on the affected server filesystem. This will execute script code in the context of the affected CGI application, typically with the privileges of the web server process.
If a remote attacker does not have access to the affected server in a manner sufficient to place malicious a Perl script to exploit this vulnerability, they may still exploit it for information disclosure purposes. Error messages that will reportedly be displayed when PerlDesk attempts to include files requested by the attacker may contain potentially sensitive information. With sufficient knowledge of the affected system, an attacker may also cause other preexisting scripts to be executed that may also aid them in further attacks.
This vulnerability may aid the attacker in further application, or system attacks.
Exploit / POC
PerlDesk Language Variable Server-Side Script Execution Vulnerability
An exploit is not required. Example URIs sufficient to exploit this vulnerability have been provided:
Http://www.example.com/cgi-bin/pdesk.cgi?lang=h4x0rs%20Rul3z
Http://www.example.com/cgi-bin/pdesk.cgi?lang=../../../../../../../proc/version%00
An exploit is not required. Example URIs sufficient to exploit this vulnerability have been provided:
Http://www.example.com/cgi-bin/pdesk.cgi?lang=h4x0rs%20Rul3z
Http://www.example.com/cgi-bin/pdesk.cgi?lang=../../../../../../../proc/version%00
Solution / Fix
PerlDesk Language Variable Server-Side Script Execution Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
PerlDesk Language Variable Server-Side Script Execution Vulnerability
References:
References:
- PerlDesk Home Page (logicNow)
- Posible Inclusion File in Perl Desk (Nikyt0x Argentina