A DOM-based XSS vulnerability was discovered in Logitech Media Server, which allows an attacker to inject malicious JavaScript code into the application. The vulnerability exists due to insufficient sanitization of user-supplied input in the 'BODY ONLOAD' parameter. A remote attacker can execute arbitrary HTML and script code in a browser in the context of the vulnerable website. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
The vulnerability was discovered during a vulnerability research lecture. This is meant to be a PoC. It is a Windows Remote Exploit which allows an attacker to execute arbitrary code on the vulnerable system by sending a maliciously crafted FTP request. The exploit is triggered when the vulnerable application attempts to process the FTP request.
The vulnerability allows remote attackers to waste CPU resources (memory consumption) via unspecified vectors.
Command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application.
The vulnerability has been confirmed on Windows 10 Enterprise 64-bit (OS version 1607, OS build 14393.1198) and Microsoft Edge 38.14393.1066.0, Microsoft EdgeHTML 14.14393. An attacker can put data they control at array+offset, they would be able to call this->_UpdateSelected with a controlled argument, which presumably would be sufficient to turn this into a write primitive.
The process hardening implemented by the VirtualBox driver can be circumvented to load arbitrary code inside a VirtualBox process giving access to the VBoxDrv driver which can allow routes to EoP from a normal user. On Windows mapped DLLs use an Image Section under the hood. This is a special type of file mapping where the parsing and relocating of the PE file is all handled by the kernel. To allow for sharing of image mappings (so ideally the kernel only needs to do the parsing and relocation once) the kernel memory manager ties the file object to an existing section object by using a unique section pointer set by the file system driver. The interesting thing about this is the section pointer doesn't necessarily ensure the file hasn't changed, just that the file system considered the file the 'same'. Therefore it's possible that opening a file and reading it returns a completely different PE file than the one you'll get if you then map that file as an image section.
The process hardening implemented by the VirtualBox driver can be circumvented to load arbitrary code inside a VirtualBox process giving access to the VBoxDrv driver which can allow routes to EoP from a normal user. The ring 3 process hardening in VirtualBox adds three hooks to module loading to try and prevent untrusted code being loaded into the process, LdrLoadDll, NtCreateSection and a LDR DLL notification. Each will try and verify a DLL load and either reject the load with an error or kill the process is it’s not possible to prevent it from occurring. Looking at the hooks there a couple of issues which when combined together allow a user to inject an arbitrary DLL into a protected process. The location checks are not very rigorous. As far as I can tell arbitrary files need to be owned by an admin/trustedinstaller but this check is waived if the file is in system32/WinSxS. However this doesn’t take into account that there are some directories which can be written to inside system32 such as Tasks. The code to enforce specific certificates doesn’t seem to be enabled so at the very least combined with 1, you can load any validly signed file. It might be considered that 2 isn’t an issue as getting a signing cert could be a sufficient burden for a “malicious” attacker, so instead it’s worth considering what else the weak path checking allows you to do. The handling of DLL paths has some interesting behaviours, most interestingly there’s the behaviour where if no file extension is added to the path then the loader will automatically append .DLL to it. This is actually imitated by the VirtualBox hooks, so if you pass a path without an extension then the hooks will also append .DLL to it. This means that if you can write a file to a directory which is in the system32 path then you can bypass the hooks and load arbitrary code.
There is a type confusion issue related to how some arithmetic operations are performed in VBScript. To illustrate, see the following simplified code of VbsVarMod static unsigned char result_lookup_table[18][18] = {...} void VbsVarMod(VAR *v1, VAR *v2) { VAR *arith_v1 = v1->PvarGetArithVal(); VAR *arith_v2 = v2->PvarGetArithVal(); int result_type = result_lookup_table[v1->vartype][v2->vartype]; if(result_type == 10) { RaiseError(...); } if(result_type == 2) { ... } else if(result_type == 3) { ... } else if(result_type == 4) { ... } v1->vartype = result_type; } where the logic for VAR::PvarGetArithVal is roughly VAR *VAR::PvarGetArithVal() { VAR *result = this->PvarGetVarVal() if(result->vartype > 17) RaiseError(...); } The VbsVarMod function (as well as many other arithmetic functions) first gets the arithmetic values of input variables and then uses the lookup table to determine the result type. PvarGetArithVal tries to ensure that the vartypes of input will be <18 so the lookup table won't be accessed out-of-bounds. The problem is that the call to v2->PvarGetArithVal() can run arbitrary script which can change the type of arith_v1. If we change v1 to an array (which typically has vartype of 8192), suddenly there will be an out-of-bound access when looking up the result type and the result type can become unexpected. In case of VbsVarMod() if the result type is not 10(Error),2(Integer),3(Long) or 4(single), the function will simply assign the result type to the result variable (v1), while the actual data will remain unchanged. This causes a type confusion in v1. Which result type an attacker can select depends on the build of vbscript.dll. On 64-bit Windows 10 in IE Version 11.1066.14393.0 (Update version 11.0.41) it is possible to set the result type to 5 (Double) which causes a heap pointer leak.
Dive Assistant - Desktop Edition comes with a template builder .exe to create print templates. The templates are saved and uploaded as XML files which are vulnerable to XXE injection. Sending a crafted payload to a user, when opened in Dive Assistant - Template Builder, will return the content of any local files to a remote attacker.
The DAX2API service installed as part of the Realtek Audio Driver on Windows 10 is vulnerable to a privilege escalation vulnerability which allows a normal user to get arbitrary system privileges. The use of .NET for DCOM is inherently unsafe and should not be used. There’s public exploit code to elevate privileges on arbitrary services available at https://github.com/tyranid/ExploitDotNetDCOM. Microsoft recommends moving from using DCOM to WCF for .NET services of different privilege levels.
Services By CQR