ePerl Handling of ISINDEX Query Vulnerability
BID:151
Info
ePerl Handling of ISINDEX Query Vulnerability
| Bugtraq ID: | 151 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | No |
| Local: | No |
| Published: | Jul 06 1998 12:00AM |
| Updated: | Jul 06 1998 12:00AM |
| Credit: | This vulnerability was posted to the Bugtraq mailing list July 6, 1998 by Tiago Luz Pinto <[email protected]>. The author of ePerl, Ralf S. Engelschall ([email protected]) posted a message to Bugtraq on July 10, 1998 with information about a patch for t |
| Vulnerable: |
Ralf S. Engelschall ePerl 2.2.12 |
| Not Vulnerable: |
Ralf S. Engelschall ePerl 2.2.13 |
Discussion
ePerl Handling of ISINDEX Query Vulnerability
A bug exists in ePerl's handling of the ISINDEX queries. When ISINDEX is used, the query is passed on the command line by the web server. This would allow an attacker to execute arbitrary code via the ePerl interpreter, with none of the restrictions enforced normally. In addition, this allows for the execution of any code on the file system.
A bug exists in ePerl's handling of the ISINDEX queries. When ISINDEX is used, the query is passed on the command line by the web server. This would allow an attacker to execute arbitrary code via the ePerl interpreter, with none of the restrictions enforced normally. In addition, this allows for the execution of any code on the file system.
Exploit / POC
ePerl Handling of ISINDEX Query Vulnerability
1) Place perl code on filesystem. This could be done via a writeable directory on anonymous ftp.
2) Determine (or guess) the path to the code to be executed.
3) Run code via an appropriate cgi-bin program:
http://foo.com/some/dir/doit.phtml?/home/ftp/incoming/executemycode.phtml
1) Place perl code on filesystem. This could be done via a writeable directory on anonymous ftp.
2) Determine (or guess) the path to the code to be executed.
3) Run code via an appropriate cgi-bin program:
http://foo.com/some/dir/doit.phtml?/home/ftp/incoming/executemycode.phtml
Solution / Fix
ePerl Handling of ISINDEX Query Vulnerability
Solution:
Upgrade to the latest version of ePerl. This package is available at http://www.engelschall.com/sw/eperl/. Version 2.2.13 and greater are not vulnerable.
Solution:
Upgrade to the latest version of ePerl. This package is available at http://www.engelschall.com/sw/eperl/. Version 2.2.13 and greater are not vulnerable.
References
ePerl Handling of ISINDEX Query Vulnerability
References:
References: