Title: SOAP::Lite Remote Arbitrary Command Execution Vulnerability
Severity: HIGH
Description:
SOAP::Lite is a collection of Perl modules providing an implementation of the Simple Object Access Protocol (SOAP). It includes support for both client and server programming.
A vulnerability has been reported in some versions of SOAP::Lite. It is possible to execute arbitrary Perl functions as the server process, including attacker supplied parameters.
When used within a server, client requests are mapped to Perl functions. Reportedly, client supplied input is used directly to build a function name, which is then passed to the call() function.
It is possible for a malicious client to include a fully qualified function name, including package information. Perl will then resolve this function name to the supplied package, as opposed to using the implied package intended by the SOAP server. This can result in arbitrary Perl functions being executed.
Reportedly, it is possible for the attacker to supply parameters to these functions. The use of a function such as POSIX::system() may then result in arbitrary shell commands being executed by the server process, and lead to local access to the vulnerable system.
It has been reported that usage of the Perl Taint feature is not sufficient to prevent exploitation of this issue.
Affected Products:
- Paul Kulchenko SOAP::Lite 0.50.0
- Paul Kulchenko SOAP::Lite 0.51.0
- Paul Kulchenko SOAP::Lite 0.52.0
References:
- Ilya Martynov: Re: Preventing package name traversal attacks
- Paul Kulchenko: Re: [soaplite] Re: Preventing package name traversal attacks
- Paul Kulchenko: SOAP::Lite Homepage
- Phrack: Phrack Magazine Volume 9, Issue 58 Dec 28 2001, article 09 of 14
- use Perl;: Serious SOAP::Lite Security Hole Discovered
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
