Guestbook CGI Remote Command Execution Vulnerability
BID:776
Info
Guestbook CGI Remote Command Execution Vulnerability
| Bugtraq ID: | 776 |
| Class: | Input Validation Error |
| CVE: |
CVE-1999-1053 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 05 1999 12:00AM |
| Updated: | Jul 11 2009 12:56AM |
| Credit: | This was discussed on the Vuln-Dev mailing list hosted by Security Focus in a thread starting on September 13, 1999. It was posted to BugTraq by Blue Boar <[email protected]> on Nov 5, 1999. |
| Vulnerable: |
Matt Wright GuestBook 2.3 |
| Not Vulnerable: | |
Discussion
Guestbook CGI Remote Command Execution Vulnerability
When Guestbook is configured to allow HTML posts and you have enabled server-side includes for HTML, it may be possible for an attacker to embed SSI (server-side include) code in guestbook messages. The server-side includes allow for remote command execution, including displaying of any files to which the web server has read access (see the example):
<!--#exec cmd="cat /etc/group"
In an attempt to stop this from happening, guestbook.pl parses for SSI commands under the assumption that they are in this format:
<-- SSI command -->
^^ Does not need to be there.
Apache will accept different formats, which can evade the regular expression in guestbook.pl, executing commands on the target host as they would [if they were put there by the author].
When Guestbook is configured to allow HTML posts and you have enabled server-side includes for HTML, it may be possible for an attacker to embed SSI (server-side include) code in guestbook messages. The server-side includes allow for remote command execution, including displaying of any files to which the web server has read access (see the example):
<!--#exec cmd="cat /etc/group"
In an attempt to stop this from happening, guestbook.pl parses for SSI commands under the assumption that they are in this format:
<-- SSI command -->
^^ Does not need to be there.
Apache will accept different formats, which can evade the regular expression in guestbook.pl, executing commands on the target host as they would [if they were put there by the author].
Exploit / POC
Guestbook CGI Remote Command Execution Vulnerability
See discussion.
See discussion.
Solution / Fix
Guestbook CGI Remote Command Execution Vulnerability
Solution:
A temporary solution is to disable server side includes in apache.
Solution:
A temporary solution is to disable server side includes in apache.