Carello E-Commerce Server Allows Remote Command Execution

ReportedMay 14, 2001, by Defcom Labs.

VERSIONAFFECTED

DESCRIPTION
Avulnerability exists in Carello E-Commerce Server 1.2.1 for Windows NT that letsan attacker run programs located on the server by using the System Securitycontext. The carello.dll uses full physical paths to execute its scripts insteadof paths relative to the Web root.

DEMONSTRATION

PeterGründl alsoprovided the following proof-of-concept scenario:

Typinghttp://foo.org/scripts/Carello/Carello.dll?CARELLOCODE=SITE2&VBEXE=C:..winntsystem32cmd.exe%20/c%20echo%20test>c:defcom.txtcreates a file on the server called “defcom.txt.”

VENDORRESPONSE

Thevendor, Carello, acknowledges thisvulnerability and has released version 1.3to correct this vulnerability.

CREDIT
Discoveredby PeterGründl.