Home page logo

bugtraq logo Bugtraq mailing list archives

NERF Advisory #2 - 1C:Arcadia multiple vulnerablilities.
From: ViperSV <vipersv () mail ru>
Date: Thu, 21 Jun 2001 20:11:46 +0700

                     --== NERF gr0up security advisory #2 ==--
      Multiple vulnerabilities in web-shop 1C: Arcadia, in module tradecli.dll

1. Show path scripts directory.

Exploit: http://host/scripts/tradecli.dll?template=nonexistfile

Will show error message, witch consist full path to work dir (usually /scripts).
Advice for developers: print this messages only to Event Log.

2. Read any file from drive.

tradecli.dll - language interpriteter of 1C: Arcadia. It will work up file, pointed in template, interpret
tags, bigining with underline sysmbol (example, <_include...>), all the rest read without changes, put in
ASCIIZ line and then print as result.

Path, pointed in variable template, will not work up for special symbols, so you can get direcory up
(..\) and the full path to file, you may read file only from drive, where lies work directory of 

Exploit: http://host/script/tradecli.dll?template=..\..\..\..\..\path\to\file

Reading of binary files will be embarrassing, because data after 0
symbol will'nt print.

Advice for developers: check for existing file, pointed in template.
Advice for admins: limit perms for tradecli.dll

3. Crash ISAPI-applications (DoS)

Opening of files: com1, com2, etc. Windows NT application will crash,
that will crash all application (1C: Arcadia), consequently site.


Advice for developers: in Windows system befor openning file, you
have to check file for existing (FindOpen etc.)
Advice for admins: wait for next release

Bug found by buggzy, NERF Security gr0up, 2001
www.nerf.ru, buggzy () nerf ru 

  By Date           By Thread  

Current thread:
  • NERF Advisory #2 - 1C:Arcadia multiple vulnerablilities. ViperSV (Jun 21)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]