IIS 1.0,Netscape Commerce Server 1.0/Communications Server 1.12,OReilly Software WebSite Professional 1.1 b BAT/.CMD Remote Command Execution

vendor:

IIS, Commerce Server, WebSite Professional

by:

SecurityFocus

7.5

CVSS

HIGH

Remote Command Execution

CWE

Product Name: IIS, Commerce Server, WebSite Professional

Affected Version From: Microsoft IIS 1.0, Netscape Commerce Server 1.0/Communications Server 1.12, O'Reilly Software WebSite Professional 1.1

Affected Version To: Microsoft IIS 1.0, Netscape Commerce Server 1.0/Communications Server 1.12, O'Reilly Software WebSite Professional 1.1

Patch Exists: No

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2001

IIS 1.0,Netscape Commerce Server 1.0/Communications Server 1.12,OReilly Software WebSite Professional 1.1 b BAT/.CMD Remote Command Execution

Some web servers that allow batch files to be executed via CGI are vulnerable to an attack whereby an intruder can execute commands on the target machine. This can be accomplished by submitting the command to be executed as a variable preceded by the ampersand (&) symbol, eg. http://targethost/cgi-bin/batfile.bat?&hostile_command. This apparently causes the server to call the function: system("batfile.bat &hostile_command") which the command interpreter interprets as separate commands. Microsoft IIS 1.0, Netscape Commerce Server 1.0/Communications Server 1.12, and O'Reilly Software WebSite Professional 1.1 are vulnerable to this attack whether or not the .BAT file requested even exists.

Mitigation:

Ensure that batch files are not accessible via CGI.

Source

Exploit-DB raw data:

IIS 1.0,Netscape Commerce Server 1.0/Communications Server 1.12,OReilly Software WebSite Professional 1.1 b BAT/.CMD Remote Command Execution

source: https://www.securityfocus.com/bid/2023/info

Some web servers that allow batch files to be executed via CGI are vulnerable to an attack whereby an intruder can execute commands on the target machine. This can be accomplished by submitting the command to be executed as a variable preceded by the ampersand (&) symbol, eg. http://targethost/cgi-bin/batfile.bat?&hostile_command. This apparently causes the server to call the function: system("batfile.bat &hostile_command") which the command interpreter interprets as separate commands. Microsoft IIS 1.0 is vulnerable to this attack whether or not the .BAT file requested even exists. Successfully exploiting this vulnerability allows an attacker to execute commands on the target machine with the privileges of the web server. This vulnerability may also be exploited via . CMD files. 

A request similar to the following is used to exploit this:

http://targethost/cgi-bin/test.bat?&dir

Variations may be possible or necessary, depending on the specific web server and configuration.