Due to a flaw in the current user input validation performed by Skype, it is possible to append additional command line arguments which are subsequently processed during the launch of Skype.exe.
Vulnerable Systems:
* Skype all versions prior to 4.2.0.1.55
Immune Systems:
* Skype version 4.2.0.1.55
In 2006 Brett Moore, discovered a similar vulnerability in Skype which led to certain security restrictions being enforced when using the Skype: URI handler. Brett s exploit at the time involved including additional command line arguments to the Skype.exe process which would send a file to a remote user when a Skype link was clicked. Changes were made to Skype to remove available command line arguments when the /URI argument is present, and to resolve the discovered injection vulnerability.
Although many of the useful arguments have been disallowed, Security-Assessment.com found that the /Datapath argument can be included and directed to a remote SMB share directly through a specially crafted Skype URI.
The Datapath argument specifies the location of the Skype configuration files and security policy. Specifying a Datapath argument will override any local security policy defined in the Windows registry.
A remote user is capable of crafting a link that when clicked, will spawn Skype.exe on a client using a Datapath location which is present on a remote SMB share. The Skype client will load any configuration or security policy present, and save the users Skype account information to the remote share.
This allows a remote user to control the Skype configuration and security policy of the local client instance of Skype. Settings such as a remote proxy can be defined, which could be used to Man in The Middle Skype communications.
Exploitation occurs when the victim clicks a malformed Skype link in Internet Explorer (6,7 or 8) or Chrome. The exploit originates from a failure to sanitise raw binary content correctly and the ability of ShellExecute() to permit URIs which contain raw binary values.
The Skype: URI handler permits the double quote and forward slash (" and /) characters within a Skype URI, but does not permit any whitespace characters (such as space, %20, +) to be included. This essentially protects Skype from a user inserting additional command line arguments directly within a Skype: link, as a command line argument separator character (whitespace) cannot be included.
However, the use of a raw binary byte is permitted by Skype and the byte is Subsequently treated as a whitespace value when parsing Skype.exe command line arguments. This provides a whitespace character, without being a traditional whitespace. This method of whitespace character injection can be used to include additional command line arguments to the Skype.exe process.
Disclosure Timeline:
11/03/2010 - Public disclosure.
