CVE-2014-0773: Advantech WebAccess Command Injection
The BWOCXRUN.BwocxrunCtrl.1 control contains a method named “CreateProcess.” This method contains validation to ensure an attacker cannot run arbitrary command lines. After validation, the values supplied in the HTML are passed to the Windows CreateProcessA API.
The validation can be bypassed allowing for running arbitrary command lines. The command line can specify running remote files (example: UNC command line).
A function exists at offset 100019B0 of bwocxrun.ocx. Inside this function, there are 3 calls to strstr to check the contents of the user specified command line. If “\setup.exe,” “\bwvbprt.exe,” or “\bwvbprtl.exe” are contained in the command line (strstr returns nonzero value), the command line passes validation and is then passed to CreateProcessA.
Other sources
The CreateProcess method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in Advantech WebAccess before 7.2 allows remote attackers to execute (1) setup.exe, (2) bwvbprt.exe, and (3) bwvbprtl.exe programs from arbitrary pathnames via a crafted argument, as demonstrated by a UNC share pathname.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Advantech WebAccessto a version that resolves this vulnerability.Fixed in 7.2
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0773?
CVE-2014-0773 is considered critical due to its ability to allow remote code execution.
How does CVE-2014-0773 affect affected software?
CVE-2014-0773 allows remote attackers to execute arbitrary programs from remote paths via the vulnerable ActiveX control.
What versions of Advantech WebAccess are affected by CVE-2014-0773?
Advantech WebAccess versions up to and including 7.1, as well as versions 5.0, 6.0, and 7.0, are affected by CVE-2014-0773.
How do I fix CVE-2014-0773?
To mitigate CVE-2014-0773, upgrade Advantech WebAccess to version 7.2 or later.
What should I do if I cannot upgrade to fix CVE-2014-0773?
If upgrading is not possible, consider implementing network segmentation and access controls to limit exposure.