exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

SEC-20051025-0.txt

SEC-20051025-0.txt
Posted Oct 27, 2005
Authored by Daniel Fabian | Site sec-consult.com

SEC-CONSULT Security Advisory 20051025-0 - The Snoop PHP web client is susceptible to a remote command execution vulnerability when a specially crafted URL is supplied. Versions 1.2 and earlier are affected.

tags | exploit, remote, web, php
SHA-256 | 3d4b8192b526f1b4f047163bef662b30bca31b99670048e5fedfcec7d1e728d6

SEC-20051025-0.txt

Change Mirror Download
SEC-CONSULT Security Advisory 20051025-0
======================================================================
title: Snoopy Remote Code Execution Vulnerability
program: Snoopy PHP Webclient
vulnerable version: 1.2 and earlier
homepage: http://snoopy.sourceforge.net
found: 2005-10-10
by: D. Fabian / SEC-CONSULT / www.sec-consult.com
======================================================================

vendor description:
---------------

Snoopy is a PHP class that simulates a web browser. It automates the
task of retrieving web page content and posting forms, for example.

Snoopy is used by various RSS parser, which are in turn used in a
whole bunch of applications like weblogs, content management systems,
and many more.


vulnerabilty overview:
---------------

Whenever an SSL protected webpage is requested with one of the many
Snoopy API calls, it calls the function _httpsrequest which takes
the URL as argument. This function in turn calls the PHP-function
exec with unchecked user-input. Using a specially crafted URL, an
attacker can supply arbitrary commands that are executed on the web
server with priviledges of the web user.

While the vulnerability can not be exploited using the Snoopy class
file itself, there may exist implementations which hand unchecked
URLs from users to snoopy.


proof of concept:
---------------

Consider the following code on a webserver:
--- code ---
<?
include "Snoopy.class.php";
$snoopy = new Snoopy;

$snoopy->fetch($_GET['url']);
echo "<PRE>\n";
print $snoopy->results;
echo "</PRE>\n";
?>
--- /code ---

Requesting this code with a manipulated URL results in execution
of arbitrary code (in this case "echo 'hello' > test.txt"). Please
consider the following url one line:

http://server/fetch.php?url=https://www.%22;+echo+'hello'+%3E+
test.txt


vulnerable versions:
---------------

It seems that version 1.2 as well as some prior versions are vulnerable
to the attack described above.

recommended fix:
---------------

Update to Snoopy version 1.2.1.


vendor status:
---------------
vendor notified: 2005-10-24
vendor response: 2005-10-24
patch available: 2005-10-24


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Unternehmensberatung GmbH

Office Vienna
Blindengasse 3
A-1080 Wien
Austria

Tel.: +43 / 1 / 409 0307 - 570
Fax.: +43 / 1 / 409 0307 - 590
Mail: office at sec-consult dot com
www.sec-consult.com

EOF Daniel Fabian / @2005
d.fabian at sec-consult dot com
Login or Register to add favorites

File Archive:

September 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    261 Files
  • 2
    Sep 2nd
    17 Files
  • 3
    Sep 3rd
    38 Files
  • 4
    Sep 4th
    52 Files
  • 5
    Sep 5th
    23 Files
  • 6
    Sep 6th
    27 Files
  • 7
    Sep 7th
    0 Files
  • 8
    Sep 8th
    1 Files
  • 9
    Sep 9th
    16 Files
  • 10
    Sep 10th
    38 Files
  • 11
    Sep 11th
    21 Files
  • 12
    Sep 12th
    40 Files
  • 13
    Sep 13th
    18 Files
  • 14
    Sep 14th
    0 Files
  • 15
    Sep 15th
    0 Files
  • 16
    Sep 16th
    21 Files
  • 17
    Sep 17th
    51 Files
  • 18
    Sep 18th
    23 Files
  • 19
    Sep 19th
    48 Files
  • 20
    Sep 20th
    36 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close