Type packetstorm
Reporter s0ftpj
Modified 2000-06-13T00:00:00


.::::::::+[ s0ftpr0ject 2K ]+::::::::.  
::::+[ Digital Security for Y2K ]+::::  
::'.g#S$"$S#n. .g#S$"$S#n. S#n.`::  
:: $$$$$ $$$$$ $$$$$ $$$$$ $$$$ ::  
:: $$$$$ $$$$$ $$$$$ $$$$ ::  
:: `$$$$$$$$$n $$$$$ $$$$$ $$$$ ::  
:: $$$$$ $$$$$s$$$$' $$$$ ::  
:: $$$$$ $$$$$ $$$$$ $$$$$ $$$$ ::  
:: `$$$$s$$$S' `$$$$ `$$$$s$$S' ::  
:::+[ Security Advisory, 004-000 ]+:::  
`::::::::+[ Jun 09, 2000 ]+:::::::::'  
Multiple Remote CGI Vulnerabilities in MailStudio2000  
by FuSyS <fusys@s0ftpj.org>,  
Naif <naif@itapac.net> and vecna <vecna@s0ftpj.org>  
---[ Systems affected ]-------------------------------------------------------  
Possibly all systems running MailStudio2000 2.0 and lower versions.  
---[ Condition of discovery ]-------------------------------------------------  
Credit for discovering the initial 'file viewing' vulnerability in one cgi,  
mailview, goes to Naif; subsequent probes by vecna and FuSyS. Credit for  
userreg 'command execution' goes to FuSyS.  
The test on MailStudio2000 began as a simple question on the mailing lists  
accessible at http://www.sikurezza.org/  
---[ Impact ]-----------------------------------------------------------------  
There are at least two distinct bugs we'll mention.  
Any user who can remotely login to MailStudio2000, can view any file on the  
system. This implies other users' e-mail is nomore private, nor is the login  
and password dbase, nor the configuration files of the running system.  
This has a medium level impact on the security of the system, as the CGI  
programs run with root permissions and privileges, permitting the attacker to  
look at the passwd/shadow files, home directories, log files ...  
Not least important, all other users' e-mail is readable by the attacker.  
Consider this as important, as MailStudio is being sold to lots of web sites  
and it is also possible to use search engines such as AltaVista to search  
for compromisable hosts, which run these CGIs.  
The worst problem however is a poor input validation in a specific CGI which  
accesses the shell to execute a command. Injecting a single non filtered  
char, we can make the remote host execute any command we wish.  
---[ Detailed description ]---------------------------------------------------  
(1) Read, and knowledge will be thine ...  
MailStudio2000 is a web based e-mail server solution from 3RSoft.com .  
It's included in the retail version of RedHat Linux 6.1 and has been reviewd  
by LinuxJournal and Dave's Central. From 3RSoft website:  
"Over 10 millions mailboxes worldwide"  
It's functionality rotates around a group of CGI applications contained in  
the cgi-auth directory of the binary distribution.  
While on the homepage the seller clearly states that the confidentiality of  
users' e-mail will be preventatively protected, the developers missed one  
of the most common problems:  
check of user input in jailed environements, to protect the bypass of the root  
directory and the examination of other, sensitive or not, files.  
This is exactly what we found here. Seems that every CGI application in  
cgi-auth directory contains the same problem. The server can look through  
authorized users, so we must first login with a valid user and password.  
The problem is, this software is mostly used for FREE web-mail services; so  
just register and get going.  
After the logon we can easily call one of the CGI, mailview.cgi as:  
it's interesting to note that simply using /etc/passwd as value for the html  
parameter will not work, as the environement has changed the root directory.  
the number of '..' you are going to use changes accordingly to the CWD of the  
MailStudio2000 software. In this case simply '/home/sysop/mailstudio2k/'.  
Just to show that every CGI seems affected, here is an example [word-wrapped]:  
Why is this important ? MailStudio2000 runs as root, by default. This means  
/etc/shadow is readable as well.  
Every users' mail, via /var/spool/mail/ or ~/userdb/login_name/inbox can be  
/etc/mailstudio.conf will merrily give away the administration port and the  
license key, if you didn't have a commercial one.  
Once we know the administration password, grabbed from the passwd or shadow  
file, we can have access to the sysop menu and even disable other people's  
These problems and attack options pose a great risk to users' privacy and  
heavily affect the security of the product.  
(2) Act, and thou shalt be free ...  
This is obviously the worst problem which is readily evident in this server.  
The CGI application userreg.cgi is used to register new users before they  
can login to the server. The problem is, anyone can execute it.  
This CGI simply executes a useradd -s /bin/noshell -p password %s  
The login name string, %s, is filtered out of capital characters, blank spaces  
and special characters, so just inserting ';' or '&' will reach nowhere.  
While trying to escape via other chars by using every single parameter, we  
noted that the simple \x0a char is accepted, as long as there are NO spaces  
in the string. And obviously, in the error logs we saw instances of the shell  
complaining for not having found our %s2 [ as in %s1\x0a%s2 ].  
So we can just execute every application we can. This is a really powerful  
option, especially when combined with the previous read-all possibility.  
The hard point is, we don't seem able to get a workable blank space to  
execute more complex command lines. So, while leaving to your fantasy and  
personal delight, the right to explore, command and conquer, we'll just  
make sure everybody understands this is a trivial joke, if elegance is not  
on your agenda:  
- simply email yourself, a normal registered web mail user, a mail,  
containing in the headers, or in the body a single line like this,  
and then  
- simply use the faulty CGI to execute something like this,  
cat < /var/spool/mail/your_login >> /etc/passwd  
to simply put the previous line in the password file. Now you can  
choose to login with a normal account, as youi can steal the password and  
shadow files, this ought not be a problem, and then su - to spj.  
[Obviously you can add more nifty lines via this e-mail trick ...]  
Or change this way /etc/shadow and /etc/securetty ... but we are sure  
you can easily find ways of executing a nice xterm back to your X  
server ;)  
Oh sure, here is the faulty CGI [word-wrapped]:  
There are many other occurences of Internal Server Errors that can  
be traced to small problems of input validation which could result in more  
serious bugs, and could make the problem worse, regarding server security.  
---[Vendor Status ]-----------------------------------------------------------  
3RSoft, developer and seller of MailStudio2000 has been contacted and informed.  
A copy of this advisory has been sent some days ago, as we wanted to wait at  
least for a working week. Sadly, we received no response. We'd like to stress  
out that between fifteen and twenty days ago, 3RSoft was notified about the  
first 'file viewing' vulnerability on one of their cgi apps on the hompage  
web-mail test. They patched that 'single' cgi, but never replied.  
So we decided to go on and advise the community, as we've been knowing this  
for quite a time, now. No information has been provided by us on this issue  
on 'underground' channels or unreleased repositories.  
---[ URLs and references ]----------------------------------------------------  
MailStudio2000 HomePage URL : http://www.3rsoft.com/  
---[ Contact informations ]---------------------------------------------------  
s0ftpr0ject 2k - Digital security for Y2K (s0ftpj)  
no-profit security research  
Internet site: http://www.s0ftpj.org  
E-mail : staff@s0ftpj.org  
All advisories and security documents are available via http at:  
http://www.s0ftpj.org ( courtesy of Metro Olografix  
http://www.olografix.org (  
This document has no copyright, feel free to distribute it without any  
limitation. Original copy of this document can be found at our Internet site  
for free.  
---[ s0ftpr0ject staff Public PGP Key ]---------------------------------------  
Type Bits/KeyID Date User ID  
pub 2600/15A01BB9 1999/07/22 S0ftPj Staff <staff@s0ftpj.org>  
Version: 2.6.3i