Vulnerable Systems:
* Applicure dotDefender for Linux/Apache 4.26
dotDefender displays an error page when blocking an attack. The error page is generated from a template which can contain various template variables. These variables are expanded into a buffer first, the result of which is then passed to AP_PRINTF() without checking for format string identifiers. Any remaining format strings are interpreted by AP_PRINTF(), allowing for a format string injection attack.
This is immediately exploitable by an unauthenticated attacker if the <%IP%> template tag is used in the error page (not the case in the default template).In this case an attacker can inject format strings in the "Host"-header. Other attack vectors may exist if the attacker manages to access the dotDefender web interface which requires a password.
Successful exploitation allows an attacker to execute arbitrary code on the server.
