BID:14463

Karrigell KS File Arbitrary Python Command Execution Vulnerability

Info

Karrigell KS File Arbitrary Python Command Execution Vulnerability

Bugtraq ID:	14463
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 31 2005 12:00AM
Updated:	Jul 31 2005 12:00AM
Credit:	Radovan Garabík reported this issue to the vendor.
Vulnerable:	Karrigell Karrigell 2.1.5 Karrigell Karrigell 2.1.4 Karrigell Karrigell 2.1.3 Karrigell Karrigell 2.1.2 Karrigell Karrigell 2.1.1 Karrigell Karrigell 2.1 Karrigell Karrigell 2.0.5 Karrigell Karrigell 2.0.4 Karrigell Karrigell 2.0.3 Karrigell Karrigell 2.0.2 Karrigell Karrigell 2.0.1 Karrigell Karrigell 2.0 Karrigell Karrigell 1.x

Not Vulnerable:	Karrigell Karrigell 2.1.8

Discussion

Karrigell KS File Arbitrary Python Command Execution Vulnerability

Karrigell is susceptible to an arbitrary Python command execution vulnerability. This issue is due to a design flaw that allows remote attackers to execute Python commands that they are not intended to have access to.

Attackers may exploit this vulnerability to execute arbitrary Python commands in the context of the Web server hosting the Karrigell framework. This allows remote malicious users to cause denial of service conditions, create or overwrite arbitrary files, and likely compromise the hosting computer.

Exploit / POC

Karrigell KS File Arbitrary Python Command Execution Vulnerability

An exploit is not required. Some example URIs have been provided.

The following examples will cause a denial of service condition:
http://www.example.com/test.ks/raw_input
http://www.example.com/test.ks/file?%22*10000000&mode=w

The following example will create a file on the local filesystem on the hosting computer:
http://www.example.com/test.ks/file?%22*2&mode=w

Solution / Fix

Karrigell KS File Arbitrary Python Command Execution Vulnerability

Solution:
The vendor has released version 2.1.8 of Karrigell to address this issue:

Karrigell Karrigell 1.x