89 lines
No EOL
3.2 KiB
Text
89 lines
No EOL
3.2 KiB
Text
|
||
Rapid7 AppSpider 6.12 Web Application Vulnerability Scanner Elevation Of Privilege
|
||
|
||
|
||
Vendor: Rapid7, Inc.
|
||
Product web page: https://www.rapid7.com
|
||
Affected version: 6.12.10.1
|
||
|
||
Summary: While today's malicious attackers pursue a variety of
|
||
goals, they share a preferred channel of attack - the millions
|
||
of custom web, mobile, and cloud applications companies deploy
|
||
to serve their customers. AppSpider dynamically scans these
|
||
applications for vulnerabilities across all modern technologies,
|
||
provides tools that speed remediation, and monitors applications
|
||
for changes.
|
||
|
||
Desc: The application suffers from an unquoted search path issue
|
||
impacting the services 'AppSpider REST Server', 'AppSpider REST Service'
|
||
and 'AppSpiderUpgradeService' for Windows deployed as part of AppSpider
|
||
solution. This could potentially allow an authorized but non-privileged
|
||
local user to execute arbitrary code with elevated privileges on the
|
||
system. A successful attempt would require the local user to be able to
|
||
insert their code in the system root path undetected by the OS or other
|
||
security applications where it could potentially be executed during
|
||
application startup or reboot. If successful, the local user’s code
|
||
would execute with the elevated privileges of the application.
|
||
|
||
Tested on: Microsoft Windows 7 Professional SP1 (EN)
|
||
Microsoft Windows 7 Ultimate SP1 (EN)
|
||
|
||
|
||
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
||
@zeroscience
|
||
|
||
|
||
Advisory ID: ZSL-2016-5344
|
||
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5344.php
|
||
|
||
Vendor: https://community.rapid7.com/docs/DOC-3455
|
||
|
||
|
||
05.07.2016
|
||
|
||
--
|
||
|
||
|
||
C:\>sc qc "AppSpider REST Server"
|
||
[SC] QueryServiceConfig SUCCESS
|
||
|
||
SERVICE_NAME: AppSpider REST Server
|
||
TYPE : 10 WIN32_OWN_PROCESS
|
||
START_TYPE : 2 AUTO_START
|
||
ERROR_CONTROL : 1 NORMAL
|
||
BINARY_PATH_NAME : C:\Program Files (x86)\Rapid7\AppSpider6\restserviceworker\WebWindowsService.exe
|
||
LOAD_ORDER_GROUP :
|
||
TAG : 0
|
||
DISPLAY_NAME : AppSpider REST Server
|
||
DEPENDENCIES :
|
||
SERVICE_START_NAME : NT AUTHORITY\NetworkService
|
||
|
||
|
||
C:\>sc qc "AppSpider REST Service"
|
||
[SC] QueryServiceConfig SUCCESS
|
||
|
||
SERVICE_NAME: AppSpider REST Service
|
||
TYPE : 10 WIN32_OWN_PROCESS
|
||
START_TYPE : 2 AUTO_START
|
||
ERROR_CONTROL : 1 NORMAL
|
||
BINARY_PATH_NAME : C:\Program Files (x86)\Rapid7\AppSpider6\RestService\WebService.exe
|
||
LOAD_ORDER_GROUP :
|
||
TAG : 0
|
||
DISPLAY_NAME : AppSpider REST Service
|
||
DEPENDENCIES :
|
||
SERVICE_START_NAME : LocalSystem
|
||
|
||
|
||
C:\>sc qc AppSpiderUpgradeService
|
||
[SC] QueryServiceConfig SUCCESS
|
||
|
||
SERVICE_NAME: AppSpiderUpgradeService
|
||
TYPE : 10 WIN32_OWN_PROCESS
|
||
START_TYPE : 3 DEMAND_START
|
||
ERROR_CONTROL : 1 NORMAL
|
||
BINARY_PATH_NAME : C:\Program Files (x86)\Rapid7\AppSpider6\AppSpiderUpgradeService\AppSpiderUpgradeService.exe
|
||
LOAD_ORDER_GROUP :
|
||
TAG : 0
|
||
DISPLAY_NAME : AppSpiderUpgradeService
|
||
DEPENDENCIES :
|
||
SERVICE_START_NAME : LocalSystem |