PeopleSoft PeopleTools IClient Servlet Arbitrary Code Execution Vulnerability
BID:9041
Info
PeopleSoft PeopleTools IClient Servlet Arbitrary Code Execution Vulnerability
| Bugtraq ID: | 9041 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 13 2003 12:00AM |
| Updated: | Nov 13 2003 12:00AM |
| Credit: | Discovery of this issue has been credited to Phil Brass and Neel Mehta of the ISS X-Force. |
| Vulnerable: |
PeopleSoft PeopleTools 8.43 PeopleSoft PeopleTools 8.42 PeopleSoft PeopleTools 8.41 PeopleSoft PeopleTools 8.40 PeopleSoft PeopleTools 8.20 PeopleSoft PeopleTools 8.19 PeopleSoft PeopleTools 8.19 PeopleSoft PeopleTools 8.18 PeopleSoft PeopleTools 8.17 PeopleSoft PeopleTools 8.16 PeopleSoft PeopleTools 8.15 PeopleSoft PeopleTools 8.14 PeopleSoft PeopleTools 8.13 PeopleSoft PeopleTools 8.12 PeopleSoft PeopleTools 8.11 PeopleSoft PeopleTools 8.10 PeopleSoft PeopleTools 8.4 |
| Not Vulnerable: | |
Discussion
PeopleSoft PeopleTools IClient Servlet Arbitrary Code Execution Vulnerability
PeopleTools ships with an IClient servlet that is designed to handle core functionality procedures on the PeopleSoft Webserver. In addition to these core procedures the IClient servlet provides for functionality that allows a third party to upload files that are attached to a form post. The uploaded files are stored in the PeopleSoft Web root.
The PeopleTools IClient servlet has been reported prone to a vulnerability that could allow a remote attacker to execute arbitrary code with the privileges of the web server process. The issue presents itself due to the weak methods used by the IClient servlet when it is generating random directory names. A remote attacker may guess the random folder name on the vulnerable server and in doing so may invoke the uploaded file and have arbitrary code executed with the privileges of the web server process.
PeopleTools ships with an IClient servlet that is designed to handle core functionality procedures on the PeopleSoft Webserver. In addition to these core procedures the IClient servlet provides for functionality that allows a third party to upload files that are attached to a form post. The uploaded files are stored in the PeopleSoft Web root.
The PeopleTools IClient servlet has been reported prone to a vulnerability that could allow a remote attacker to execute arbitrary code with the privileges of the web server process. The issue presents itself due to the weak methods used by the IClient servlet when it is generating random directory names. A remote attacker may guess the random folder name on the vulnerable server and in doing so may invoke the uploaded file and have arbitrary code executed with the privileges of the web server process.
Exploit / POC
PeopleSoft PeopleTools IClient Servlet Arbitrary Code Execution Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
PeopleSoft PeopleTools IClient Servlet Arbitrary Code Execution Vulnerability
Solution:
It has been reported that vendor supplied fixes to address this issue are pending release. Customers affected by this issue are advised to contact the vendor for further details.
Solution:
It has been reported that vendor supplied fixes to address this issue are pending release. Customers affected by this issue are advised to contact the vendor for further details.
References
PeopleSoft PeopleTools IClient Servlet Arbitrary Code Execution Vulnerability
References:
References:
- PeopleSoft Customer Connection (PeopleSoft)
- PeopleSoft Homepage (PeopleSoft)
- PeopleSoft IClient Servlet Remote Command Execution Vulnerability (X-Force)