badblue.txt

`BadBlue Arbitrary Administrative Actions Vulnerability  
  
I. Synopsis  
  
Author: Matthew Murphy ([email protected])  
Release Date: April 20, 2003  
Vendor References:  
* http://www.badblue.com  
* http://www.badblue.com/down.htm  
Affected Systems: BadBlue 2.15 and prior  
Risk: High  
Issue: A vulnerability enabling attackers to gain administrative control of  
a vulnerable server.  
Recommendations:  
* Personal Edition customers should download BadBlue 2.16, available now  
* Enterprise Edition customers should contact Working Resources for a fixed  
version  
  
II. Description  
  
BadBlue is a powerful Web/P2P server with native Gnutella capabilities,  
filters, CGI, and ISAPI. It ships with an ISAPI module that provides an  
HTML-embedded dynamic web page language; this language powers the BadBlue  
WBA.  
  
The BadBlue ISAPI module allows page parsing with the LoadPage command, via  
the following syntax:  
  
http://[target]/ext.dll?MfcIsapiCommand=LoadPage&page=[pagename]&a0=[arg]&a1  
=...  
  
The DLL attempts to prevent remote users from accessing .hts pages by  
checking the 'referer' HTTP header of requests, and also verifying that all  
requests for .hts pages originate from 127.0.0.1 (the loopback).  
  
By appending certain illegal characters to the requested filename, it is  
possible to cause BadBlue to interpret .hts files from a remote system,  
thereby yielding administrative control of the server to the attacker.  
  
III. Impact  
  
By issuing a specially-crafted request, such as:  
  
http://[target]/ext.dll?MfcIsapiCommand=LoadPage&page=admin.hts%20&a0=add&a1  
=root&a2=%5C  
  
An attacker can perform any administrative action on the server. The  
example above adds a '/root' virtual directory that maps to the '\' path.  
The attacker can then request the ext.ini file with the following request:  
  
http://[target]/Program%20Files/BadBlue/PE/ext.ini  
  
This will vary depending on the version/path of BadBlue's installation on  
the system, but listing of virtual directories is enabled by default,  
meaning that an attacker can traverse through the system, scanning for files  
of interest.  
  
IV. Vendor Response  
  
Working Resources was contacted on April 12, 2003. The latest version  
(2.16) fixes this vulnerability. Personal Edition users may download this  
from:  
  
http://www.badblue.com/down.htm  
  
Enterprise Edition customers should contact Working Resources for an  
upgrade.  
  
`