Chpasswd is a utility allows your users to change his/her Squid or Web password using the browser. A lot of vulnerabilities have been found allowing remote attackers to get a "shadow's tail" without a valid user (Exploit Code Below) and (a possible) local exploit to get the root shell.
Credit:
This information has been provided by Victor Pereira.
Vulnerable systems:
* chetcpasswd version 1.2 and earlier
Exploit:
If you fill the form with 120 chars in the user field, the system return the shadow file's tail without any restriction.
Exploit Code (Remote):
#!/usr/bin/perl -w
#Exploit coded by Victor Pereira <vpereira@modulo.com.br>
#Thanks to Alexandre Vargas And Thiago Zaninotti
use strict;
use Socket;
my ($remote,$port, $iaddr, $paddr, $proto,$linha,$query,$len_query,$ARGC,$fakeuser,$linhas,$pattern);
Well, the code trust in a enviroment variable named PATH, if you create a script named "cp", change the value of the PATH variable, then you can via WWW interface can exec your cp.
And then via Web interface you try to change your password.
Workaround:
From the README:
Create /etc/chetcpasswd.allow file with IP's or sub-nets allowed to use.
Eg.: 192.168.82.10 - only this IP will use
192.168.82.0 - IP's from 1 to 255
192.168.0.0 - ...
192.0.0.0 - ...
0.0.0.0 - allow anybody. A bad choice...
