Anon Proxy Server - Remote Code Execution

2007.12.20

Credit: Michael Brooks

Risk: High

Local: No

Remote: Yes

CVE: CVE-2007-6459

CWE: CWE-94

CVSS Base Score: 6.8/10

Impact Subscore: 6.4/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

By Michael Brooks
Vulnerability type: Multiple Remote System commands execution.
Software: Anon Proxy Server
Home page:http://sourceforge.net/projects/anonproxyserver/
Affects version: 0.100
Example exploit:
http://127.0.0.1/anon_proxy_server_0.100/diagdns.php?host=google.com%5C%
27+%26%26+cat+%2Fetc%2Fpasswd+%23
A virtually identical flaw exists in diagconnect.php however it takes longer to execute.
Anon Proxy Server forces magic_quotes_gpc=on, However magic_quotes_gpc does not protect the system() function from taint. For protection you should use the escapeshellarg() function. Removing diagdns.php and diagconnect.php is the best temporary solution. Also magic_quotes_gpc is being removed in php6, so Anon Proxy Server will have to revamp there security.
Peace

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Anon Proxy Server - Remote Code Execution

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.