exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

badblue.txt

badblue.txt
Posted Apr 21, 2003
Authored by Matthew Murphy

BadBlue web server versions 2.15 and below have a vulnerability that allows remote attackers to gain administrative control of a server. The ext.dll that allows pages parsing with the LoadPage command attempts to prevent remote users from accessing .hts pages by checking the 'referer' HTTP header of requests, and also verifying that all requests for .hts pages originate from 127.0.0.1 (the loopback). By appending certain illegal characters to the requested filename, it is possible to cause BadBlue to interpret .hts files from a remote system, thereby yielding administrative control of the server to the attacker.

tags | exploit, remote, web
SHA-256 | 7c9fcc98b57a0be0b7411ecaa6864241a66336a2bf516c6147bd84a47cdcbafb

badblue.txt

Change Mirror Download
BadBlue Arbitrary Administrative Actions Vulnerability

I. Synopsis

Author: Matthew Murphy (mattmurphy@kc.rr.com)
Release Date: April 20, 2003
Vendor References:
* http://www.badblue.com
* http://www.badblue.com/down.htm
Affected Systems: BadBlue 2.15 and prior
Risk: High
Issue: A vulnerability enabling attackers to gain administrative control of
a vulnerable server.
Recommendations:
* Personal Edition customers should download BadBlue 2.16, available now
* Enterprise Edition customers should contact Working Resources for a fixed
version

II. Description

BadBlue is a powerful Web/P2P server with native Gnutella capabilities,
filters, CGI, and ISAPI. It ships with an ISAPI module that provides an
HTML-embedded dynamic web page language; this language powers the BadBlue
WBA.

The BadBlue ISAPI module allows page parsing with the LoadPage command, via
the following syntax:

http://[target]/ext.dll?MfcIsapiCommand=LoadPage&page=[pagename]&a0=[arg]&a1
=...

The DLL attempts to prevent remote users from accessing .hts pages by
checking the 'referer' HTTP header of requests, and also verifying that all
requests for .hts pages originate from 127.0.0.1 (the loopback).

By appending certain illegal characters to the requested filename, it is
possible to cause BadBlue to interpret .hts files from a remote system,
thereby yielding administrative control of the server to the attacker.

III. Impact

By issuing a specially-crafted request, such as:

http://[target]/ext.dll?MfcIsapiCommand=LoadPage&page=admin.hts%20&a0=add&a1
=root&a2=%5C

An attacker can perform any administrative action on the server. The
example above adds a '/root' virtual directory that maps to the '\' path.
The attacker can then request the ext.ini file with the following request:

http://[target]/Program%20Files/BadBlue/PE/ext.ini

This will vary depending on the version/path of BadBlue's installation on
the system, but listing of virtual directories is enabled by default,
meaning that an attacker can traverse through the system, scanning for files
of interest.

IV. Vendor Response

Working Resources was contacted on April 12, 2003. The latest version
(2.16) fixes this vulnerability. Personal Edition users may download this
from:

http://www.badblue.com/down.htm

Enterprise Edition customers should contact Working Resources for an
upgrade.

Login or Register to add favorites

File Archive:

December 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    2 Files
  • 2
    Dec 2nd
    12 Files
  • 3
    Dec 3rd
    0 Files
  • 4
    Dec 4th
    0 Files
  • 5
    Dec 5th
    0 Files
  • 6
    Dec 6th
    0 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close