[NT] Windows File Selection May Lead to Command Execution

From: SecuriTeam (support_at_securiteam.com)
Date: 04/21/05

  • Next message: SecuriTeam: "[NEWS] Neslo Desktop Rover Remote DoS" 
    To: list@securiteam.com
Date: 21 Apr 2005 16:15:38 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Windows File Selection May Lead to Command Execution
    ------------------------------------------------------------------------

    SUMMARY

    When the preview pane outputs the document's author name, it checks
    whether the name resembles an email address, and if so, transforms it into
    a 'mailto:' link in the pane. The transformation into a link does not
    filter potentially dangerous characters and makes it possible to inject
    attributes into the link, which enables execution of arbitrary script
    commands.

    DETAILS

    Vulnerable Systems:
     * Windows Explorer on Windows 2000 Professional
     * Windows Explorer on Windows 2000 Server
     * Windows Explorer on Windows 2000 Advanced Server

    Note that any other application that uses the Web View DLL under Windows
    2000 is affected as well.

    Introduction:
    Windows Explorer is used to navigate through the Windows file system by
    default.

    Windows Explorer includes a preview pane (Web view), which displays
    information on some types of files when they become selected. The preview
    pane is enabled by default on all Windows 2000 systems.

    The preview pane is implemented via an HTML resource file (in webvw.dll),
    which examines the currently selected file, reads its metadata and
    displays useful information about it. Such information includes the file's
    size, attributes, modification date, author and more.

    Script commands that are injected in this manner will execute as soon as
    the malicious file is selected in Windows Explorer and will be executed in
    a trusted context, which means they will have the ability to perform any
    action the currently logged on user can perform. This includes reading,
    deleting and writing files, as well as executing arbitrary commands.

    Notice that the malicious file does not need to be executed in order to
    activate the exploit, double-clicking is not required. The exploitation
    takes place as soon as the file is selected.

    The code below is an excerpt from one of the vulnerable resources. In this
    instance 'safeData' has not been filtered properly, and may contain the
    apostrophe (') character, allowing for attribute termination in the
    resulting HTML:

    text += "<p>" + title + ": <a href='mailto:" + safeData + "'>" + safeData
    + "</a>";

    Exploit:
    When setting the author field of a file (for example, a Word document) to
    the following value:
    a@b' style='background-image:url(javascript:alert("Successful
    injection!"))'

    Windows Explorer will display a message box as soon as the file is
    selected.

    This vulnerability can also be exploited by directing the user to an
    attacker controlled SMB share, the user will then need to select the file
    in order to activate the exploit.

    Demonstration:
    GreyMagic has put together three proof-of-concept demonstrations:
     * Simple: As shown in the exploit section, displays a simple message box
    when selected.
     * Copy me: Automatically copies itself to the same folder when selected.
     * Bo Selecta: Constantly renames itself when selected.

    They may be accessed at:
    <http://security.greymagic.com/security/advisories/gm015-ie/>
    http://security.greymagic.com/security/advisories/gm015-ie/

    Solution:
    Until a patch becomes available, disable the Web View by going to: Tools
    -> Folder Options -> Select 'Use Windows classic folders'.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:security@greymagic.com>
    GreyMagic Security.
    The original article can be found at:
    <http://www.greymagic.com/security/advisories/gm015-ie/>
    http://www.greymagic.com/security/advisories/gm015-ie/

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NEWS] Neslo Desktop Rover Remote DoS"