[VulnWatch] BadBlue Remote Administrative Access Vulnerability

From: Matthew Murphy (mattmurphy@kc.rr.com)
Date: 04/20/03

  • Next message: Matthew Murphy: "[VulnWatch] Monkey HTTPd Remote Buffer Overflow"
    From: "Matthew Murphy" <mattmurphy@kc.rr.com>
    To: "VulnWatch" <vulnwatch@vulnwatch.org>, "SecurITeam News" <news@securiteam.com>, "BugTraq" <bugtraq@securityfocus.com>, "Full Disclosure" <full-disclosure@lists.netsys.com>
    Date: Sun, 20 Apr 2003 16:28:18 -0500
    
    

    BadBlue Arbitrary Administrative Actions Vulnerability

    I. Synopsis

    Author: Matthew Murphy (mattmurphy@kc.rr.com)
    Release Date: April 20, 2003
    Vendor References:
     * http://www.badblue.com
     * http://www.badblue.com/down.htm
    Affected Systems: BadBlue 2.15 and prior
    Risk: High
    Issue: A vulnerability enabling attackers to gain administrative control of
    a vulnerable server.
    Recommendations:
     * Personal Edition customers should download BadBlue 2.16, available now
     * Enterprise Edition customers should contact Working Resources for a fixed
    version

    II. Description

    BadBlue is a powerful Web/P2P server with native Gnutella capabilities,
    filters, CGI, and ISAPI. It ships with an ISAPI module that provides an
    HTML-embedded dynamic web page language; this language powers the BadBlue
    WBA.

    The BadBlue ISAPI module allows page parsing with the LoadPage command, via
    the following syntax:

    http://[target]/ext.dll?MfcIsapiCommand=LoadPage&page=[pagename]&a0=[arg]&a1
    =...

    The DLL attempts to prevent remote users from accessing .hts pages by
    checking the 'referer' HTTP header of requests, and also verifying that all
    requests for .hts pages originate from 127.0.0.1 (the loopback).

    By appending certain illegal characters to the requested filename, it is
    possible to cause BadBlue to interpret .hts files from a remote system,
    thereby yielding administrative control of the server to the attacker.

    III. Impact

    By issuing a specially-crafted request, such as:

    http://[target]/ext.dll?MfcIsapiCommand=LoadPage&page=admin.hts%20&a0=add&a1
    =root&a2=%5C

    An attacker can perform any administrative action on the server. The
    example above adds a '/root' virtual directory that maps to the '\' path.
    The attacker can then request the ext.ini file with the following request:

    http://[target]/Program%20Files/BadBlue/PE/ext.ini

    This will vary depending on the version/path of BadBlue's installation on
    the system, but listing of virtual directories is enabled by default,
    meaning that an attacker can traverse through the system, scanning for files
    of interest.

    IV. Vendor Response

    Working Resources was contacted on April 12, 2003. The latest version
    (2.16) fixes this vulnerability. Personal Edition users may download this
    from:

    http://www.badblue.com/down.htm

    Enterprise Edition customers should contact Working Resources for an
    upgrade.


  • Next message: Matthew Murphy: "[VulnWatch] Monkey HTTPd Remote Buffer Overflow"

    Relevant Pages