Eval injection vulnerability in awstats.pl in AWStats 6.4 and earlier, when a URLPlugin is enabled, allows remote attackers to execute arbitrary Perl code via the HTTP Referrer, which is used in a $url parameter that is inserted into an eval function call.

Peter Vreugdenhil discovered that awstats, a featureful web server log analyser, passes user-supplied data to an eval() function, allowing remote attackers to execute arbitrary Perl commands.

An iDEFENSE Security Advisory reports :

Remote exploitation of an input validation vulnerability in AWStats allows remote attackers to execute arbitrary commands.

The problem specifically exists because of insufficient input filtering before passing user-supplied data to an eval() function. As part of the statistics reporting function, AWStats displays information about the most common referrer values that caused users to visit the website. The referrer data is used without proper sanitation in an eval() statement, resulting in the execution of arbitrary perl code.

Successful exploitation results in the execution of arbitrary commands with permissions of the web service. Exploitation will not occur until the stats page has been regenerated with the tainted referrer values from the http access log. Note that AWStats is only vulnerable in situations where at least one URLPlugin is enabled.

Peter Vreugdenhil discovered a command injection vulnerability in AWStats. As part of the statistics reporting function, AWStats displays information about the most common referrer values that caused users to visit the website. Referer URLs could be crafted in a way that they contained arbitrary Perl code which would have been executed with the privileges of the web server as soon as some user visited the referrer statistics page.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200508-07 (AWStats: Arbitrary code execution using malicious Referrer information)

    When using a URLPlugin, AWStats fails to sanitize Referrer URL     data before using them in a Perl eval() routine.
  Impact :

    A remote attacker can include arbitrary Referrer information in a     HTTP request to a web server, therefore injecting tainted data in the     log files. When AWStats is run on this log file, this can result in the     execution of arbitrary Perl code with the rights of the user running     AWStats.
  Workaround :

    Disable all URLPlugins in the AWStats configuration.

The remote host is running AWStats, an open source web analytics tool used for analyzing data from internet services such as web, streaming, media, mail and FTP servers.

The version of AWStats installed on the remote host collects data about the web referrers and uses them without proper sanitation in an eval() statement.  Using specially crafted referrer data, an attacker can cause arbitrary Perl code to be executed on the remote host within the context of the affected application once the stats page has been regenerated and when a user visits the referer statistics page.

Note that successful exploitation requires that at least one URLPlugin is enabled.

The remote host is running AWStats, a CGI log analyzer.  There are various content-parsing flaws in the remote version of this software that would allow an attacker to execute code on the remote host.  An attacker exploiting this flaw would only need to be able to generate HTTP requests to the awstats.pl CGI script.  A successful attack would allow the attacker to run system commands with the privileges of the CGI script.

ID	Name	Product	Family	Severity
22758	Debian DSA-892-1 : awstats - missing input sanitising	Nessus	Debian Local Security Checks	medium
21528	FreeBSD : awstats -- arbitrary code execution vulnerability (e86fbb5f-0d04-11da-bc08-0001020eed82)	Nessus	FreeBSD Local Security Checks	medium
20573	Ubuntu 5.04 : awstats vulnerability (USN-167-1)	Nessus	Ubuntu Local Security Checks	medium
19440	GLSA-200508-07 : AWStats: Arbitrary code execution using malicious Referrer information	Nessus	Gentoo Local Security Checks	medium
19415	AWStats Referrer Header Arbitrary Command Execution	Nessus	CGI abuses	medium
2613	AWStats < 6.5 Perl Content-Parsing Code Execution	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2005-1527

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium