[原文]Sdbsearch.cgi in SuSE Linux 6.0-7.2 could allow remote attackers to execute arbitrary commands by uploading a keylist.txt file that contains filenames with shell metacharacters, then causing the file to be searched using a .. in the HTTP referer (from the HTTP_REFERER variable) to point to the directory that contains the keylist.txt file.
An input validation error exists in sdb, the SuSE Support Data Base.
The problem exists in the sdbsearch.cgi script, which uses data directly from the 'Referer' header field from a HTTP request as a path when opening it's "keylist.txt" file. The keylist file contains a list of keywords and associated files, which are opened using Perl's open() command.
If an attacker is able to create a malicious "keylist.txt" file on a vulnerable host, it may be possible for the attacker to cause arbitrary commands to be executed by the sdbsearch.cgi script.
Proof of concept is very simple, just create harmful keylist.txt for instance in /tmp directory and send request to http server like this:
GET /cgi-bin/sdbsearch.cgi?stichwort=keyword HTTP/1.0
(very deep traversal because we don't know what is DOCUMENT_ROOT)
and an example content of our /tmp/keylist.txt create like this:
$ echo -e "keyword\0touch exploitable|" > /tmp/keylist.txt
After successful attempt there will be "exploitable" file in /tmp directory.
SuSE Support Data Base (sdb) sdbsearch.cgi Arbitrary Command Execution
Remote / Network Access
Loss of Integrity
The SuSe Support Data Base search script (sdbsearch.cgi) contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to script trusting the HTTP_REFERER field in a web request as the valid path to 'keyfile.txt'. If a malicious 'keyfile.txt' file is created on the server an attacker can set HTTP_REFERER to the path of the bogus 'keyfile.txt' and sbsearch.cgi will execute the commands in the file.