Command Injection Vulnerability in DNSTools

vendor:

DNSTools

by:

SecurityFocus

8.8

CVSS

HIGH

Command Injection

CWE

Product Name: DNSTools

Affected Version From: 1.0.8

Affected Version To: 1.1

Patch Exists: YES

Related CWE: CVE-2001-0753

CPE: a:dnstools:dnstools

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2001

Command Injection Vulnerability in DNSTools

DNSTools version 1.0.8 and 1.10 are vulnerable to command injection due to lack of input validation. By manipulating the contents of certain post variables, arbitrary code may be executed. This can be done by sending a GET request to the webserver or cgi-bin with a malicious payload. For example, sending a GET request with the payload "domain_name=";ls""' will cause a directory listing."

Mitigation:

Input validation should be performed on user-supplied data to prevent malicious payloads from being executed.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/1028/info

A vulnerability exists in the 1.0.8 release of DNSTools (labeled on some areas of their site as 1.08), from DNSTools Software. By manipulating the contents of certain post variables, arbitrary code may be executed.

Note that version 1.10 is reportedly still vulnerable. See message from Wolfgang Wiese <wolfgang.wiese@rrze.uni-erlangen.de> in reference section.

The problem stems from the following code:

$host_name = $CGI->param("host_name"); 
$domain_name = $CGI->param("domain_name");

$error_description = ""; 
my $error_code = system("/usr/local/dnstools/delete_mx -d \"$domain_name\" -n \"$host_name\"");

No escaping or input validation is performed. This makes it easy for a would be attacker to execute arbitrary commands, as the user the webserver or cgi-bin is being run as.

The key to this exploit is causing the system() call to execute commands other than the intended one. The following would cause a directory listing: GET /~jed/cgi-bin/test.pl?domain_name=\"\;ls\" HTTP/1.0