[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : Oracle Hyperion Financial Management TList6 ActiveX Control Remote Code Execution
# Published : 2011-11-02
# Author :
# Previous Title : Apple Safari file:// Arbitrary Code Execution
# Next Title : HP Easy Printer Care XMLCacheMgr Class ActiveX Control Remote Code Execution


Oracle Hyperion Financial Management TList6 ActiveX 
Control Remote Code Execution Vulnerability

tested against: Internet Explorer 8
                Microsoft Windows Server 2003 r2 sp2

download url:
http://www.oracle.com/technetwork/middleware/epm/downloads/index.html

files tested:
SystemInstaller-11121-win32.zip
FoundationServices-11121-win32-Part1.zip
FoundationServices-11121-win32-Part2.zip
FoundationServices-11121-win32-Part3.zip
FoundationServices-11121-win32-Part4.zip
FoundationServices-11121-Part5.zip
FoundationServices-11121-Part6.zip
FoundationServices-11121-Part7.zip
StaticContent-11121.zip
RandAFoundation-11121.zip
EPM_Architect-11121.zip
HyperionFinancialManagement-11121.zip

Background:

the mentioned program installs an ActiveX control with the following
settings:

Binary Path: C:WINDOWSsystem32TList6.ocx
ProgID: TList.TList.6
CLSID: {65996200-3B87-11D4-A21F-00E029189826}
Safe for Initialization (Registry): True
Safe for Scripting (Registry): True

This control is marked "safe for scripting" and "safe for initialization",
Internet Explorer will allows scripting of this control.


Vulnerability:

The mentioned class contains the vulnerable SaveData() method, see typelib:

...
	/* DISPID=167 */
	/* VT_I2 [2] */
	function SaveData(
		/* VT_BSTR [8]  */ $lpszFileName 
		)
	{
	}
...

which allows to create / overwrite files with arbitrary extensions
inside arbitrary locations ex. automatic startup folders. By manipulating 
ex. the Caption property is possible to create a valid application 
with .hta extension.

The resulting file will look like this:

0000  00 62 99 65 87 3b d4 11  a2 1f 00 e0 29 18 98 26   .b?e?;?. ..).?&
0010  09 00 06 00 ac 14 00 00  ac 14 00 00 e4 00 00 00   ....?... ?...?...
0020  00 03 52 e3 0b 91 8f ce  11 9d e3 00 aa 00 4b b8   ..R?.?? .??.a.K?
0030  51 01 00 00 00 90 01 c0  d4 01 00 0f 54 69 6d 65   Q....?. ?...Time
0040  73 20 4e 65 77 20 52 6f  6d 61 6e 01 00 01 01 00   s New Ro man.....
0050  08 00 00 80 05 00 00 80  0e 00 00 80 0d 00 00 80   ...