what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Sawmill Enterprise Code Execution / Cross Site Request Forgery / Cross Site Scripting

Sawmill Enterprise Code Execution / Cross Site Request Forgery / Cross Site Scripting
Posted Oct 22, 2010
Authored by Johannes Greil | Site sec-consult.com

Sawmill Enterprise versions prior to suffers from arbitrary code execution, cross site request forgery, cross site scripting and various other vulnerabilities. suffers from buffer overflow, cross site request forgery, cross site scripting and file disclosure vulnerabilities.

tags | exploit, overflow, arbitrary, vulnerability, code execution, xss, csrf
SHA-256 | 2bd10f0a3d3cc78cbdd70e360341145cdcc41d59f78c199e223b197ec74303a1

Sawmill Enterprise Code Execution / Cross Site Request Forgery / Cross Site Scripting

Change Mirror Download
SEC Consult Security Advisory < 20101021-0 >
title: Multiple critical vulnerabilities
product: Sawmill - Universal Log File Analysis
vulnerable version: Sawmill Enterprise < v8.1.7.3
fixed version: v8.1.7.3
impact: critical
homepage: http://www.sawmill.net
found: 2010-07-20
by: J. Greil / SEC Consult / www.sec-consult.com

Vendor description:
"Sawmill is universal log analysis software that runs on every major
platform. It can process almost any type of log data. The reports that
Sawmill generates are hierarchical, attractive, and heavily
cross-linked for easy navigation. Complete documentation is built
directly into the program."


Vulnerability overview/description:
Sawmill suffers from multiple critical vulnerabilities which allow an
_unauthenticated_ attacker to gain administrative rights. Furthermore
it is possible to access (RW) the file system and execute arbitrary
commands on the operating system without authentication.

Attackers with valid accounts are able to reset the root password or
add/delete log profiles, view and manipulate admin settings etc.

It must be noted that further vulnerabilities are to be expected
within the software (such as buffer overflows, etc.). Due to lack of
time no further vulnerabilities could be searched.

1) Unauthenticated access to critical functions
Unauthenticated attackers are e.g. able to create new user accounts
with administrative "Manager" roles. It is possible to exploit the
built-in "salang" scripting language to read/write files on the file
system (e.g. user configuration with MD5 hashes), connect to other
internal systems or execute arbitrary operating system commands.

2) Insufficient validation of user access rights
Users with standard access rights/roles (e.g. "Statistics Visitor") are
able to access functions or methods of the Sawmill application where
they shouldn't have access to (default permissions of installation).

"Statistics visitor" users are able to access administrative functions
or admin menus in order to gain sensitive information or even manipulate
settings, create new profiles or delete profiles. The creation of new
profiles also results in a denial-of-service (temporarily until admin
deletes profiles) if more profiles are being created than the license
currently allows.

It is possible to access the Sawmill setup page in order to reset the
Sawmill root username and password with a standard user account.

A standard user is also able to gain access to more functions within
the interface (e.g. regarding profiles) just by changing local
JavaScript variables, e.g. through an intercepting proxy server.

There are many parameters which are not properly sanitised and
vulnerable to XSS. Furthermore no protection against CSRF is in place
which e.g. allows remote attackers to reset the root password by
e.g. exploiting the vulnerabilities in section 1 or 2.

Proof of concept:
1) Unauthenticated access to critical functions

* Create a user account with admin rights:

* Read files of the file system:

(error() call is needed to print the output within the web interface
instead of stdout)

* Write files:
E.g. use the write_file() method

* Execute OS commands:
(exec() only returns PID and no output. I'll leave it to the
creativity of the reader to further exploit this :))

2) Insufficient validation of user access rights

* Access to the "new profile wizard" including file browser as standard
"Statistics viewer" user:
This feature also allows to choose arbitrary files as log analysis
input and to disclose its contents then (file disclosure):


* Access the Sawmill setup page to reset Sawmill root password:

* Gain sensitive information, such as config/user settings:

[... see file system for further pages ...]

* Manipulate/create/delete user accounts:
POST /?dp+templates.admin_pages.users.save_data
Host: $host


* Changing local variables:
By changing the local JS variables "isrootAdmin", "isAdd", "isDelete",
etc. from "false" to "true" an attacker is able to unlock "hidden"
features and e.g. is able to manipulate other profiles on the index page
(other profiles can be deleted!).

3) XSS (valid session necessary, payload will be auto-executed after

Unauthenticated XSS:

CSRF to reset root account to chosen password (valid standard user
session necessary):

Vulnerable / tested versions:
Sawmill Enterprise v8.1.5.1 (running on Linux)

Older versions may be vulnerable too, but have not been tested as
v8.1.5.1 is the latest version available at the time of testing
(July 2010).

During the time of fixing, v8.1.6.3 has been tested shortly and the
most critical flaws have not yet been fixed in this version.

Furthermore, some pre-release builds after v8.1.6.3 have been shortly
tested too.

Vendor contact timeline:
2010-07-29: Contacting Sawmill via email and asking for a security
contact (sales@ and support@sawmill.co.uk)
2010-07-29: Quick reply of Sawmill Sales and Support team
Sent advisory to given contact
2010-07-29: Again quick reply of given contact with estimated fixing
time (early September with next release 8.1.6)
2010-07-30: Confirmation of vulnerabilities from vendor
2010-08-02: Asking for information which Sawmill versions are affected
2010-08-12: Vendor: Fixing is in progress, version info will be
collected in an internal document
2010-09-01: Vendor: problems mostly fixed in upcoming 8.1.6 in about
two weeks
2010-09-07: New release available, does not fix critical
2010-09-08: Pre-release version available, very shortly checked for fix
of critical vulnerabilities, 8.1.7 is scheduled, XSS still
2010-09-21/24: v8.1.7 will be released soon, fixes most critical bugs.
Short-term plan to implement URL parameter filtering
against XSS in future versions
2010-10-01: Sending new advisory draft to sawmill for review
2010-10-07: v8.1.7 still under QA
2010-10-13: v8.1.7.3 is available: Fixes reported flaws, CSRF
protection will come in future releases.
2010-10.21: Coordinated release date

Special thanks to Greg!

Upgrade to the latest available version v8.1.7.3


Restrict access to the software as much as possible. Only allow trusted
IP addresses and users in order to minimise attack surface. No other
proper workaround is available.

Advisory URL:

SEC Consult Unternehmensberatung GmbH

Office Vienna
Mooslackengasse 17
A-1190 Vienna

Tel.: +43 / 1 / 890 30 43 - 0
Fax.: +43 / 1 / 890 30 43 - 25
Mail: research at sec-consult dot com

EOF J. Greil / @2010
Login or Register to add favorites

File Archive:

February 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    11 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    5 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    0 Files
  • 6
    Feb 6th
    9 Files
  • 7
    Feb 7th
    32 Files
  • 8
    Feb 8th
    0 Files
  • 9
    Feb 9th
    0 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    0 Files
  • 13
    Feb 13th
    0 Files
  • 14
    Feb 14th
    0 Files
  • 15
    Feb 15th
    0 Files
  • 16
    Feb 16th
    0 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By