RCE In AddThis
This vulnerability has been fixed as of July 20, 2016 and is shared with consent from the vendor.
If
you wish to share the information provided in the write up, provide
credit for the original author or contact [email protected] for more
info. Timeline of the report
- July 20, 2016 8:59 AM: Vulnerability is reported to the vendor through [email protected]
- July 20, 2016 11:56 AM: Initial reply from the vendor regarding confirmation and process
- July 20, 2016 12:00 AM: Vendor patches the vulnerability.
AddThis launched a responsible disclosure program quite a while ago. I had never paid attention to it until yesterday when I was browsing some articles regarding public exploits and vulnerabilities. One of the article was written by the team at Detectify. This article dealt with possibility of having a remote code execution if a Werkzeug debugger was publicly available.
I started to look into what is known as the Hackers Google, Shodan. During the research of this exploit I noticed that AddThis also had this installed.
During the inital research, Shodan showed that AddThis
might be suspectible to this vulnerability. However there was IP address
with the port provided. I started to look more into this and was soon
able to confirm that this IP blcock was assigned to AddThis server. Now I
wanted to find the domain associated as well. This was not a hard one
to find.
The domain and port associated was addth.is:5000. addth.is was a domain used by AddThis to redirect its user to addthis.com if they had clicked any link from sites like Twitter.
This vulnerability was previously reported through the contact page from AddThis however I soon found that the contact page was not working correctly. So I decided to email from [email protected] which worked. Within 2 hours of the initial report, the vulnerability was patched and currently the page shows 503 service unavailable.
