A vulnerability in ibrow NewsDesk allows an attacker to view files and execute operating system commands with the privileges of the web server.
ibrow NewsDesk is a Perl CGI script that is designed to create and display news articles on a web site. The code for NewsDesk is implemented in the file newsdesk.cgi. This code accepts input from a URL and uses this data in an argument to the Perl open() command. Since NewsDesk does not adequately filter URL input, it is possible to construct a URL containing shell meta-characters such as "../" and "|" (pipe), and these characters will be processed with the privileges of the web server.
By submitting a specially crafted URL, an attacker can execute operating system commands and traverse the file system and read files with the permission of the web server.
The CERT/CC is currently unaware of a practical solution to this problem.
The CERT Coordination Center acknowledges
This document was written by Art Manion.
|Date First Published:||2002-04-02|
|Date Last Updated:||2002-04-08 18:38 UTC|