[Full-Disclosure] STG Security Advisory: [SSA-20041224-21] File extensions restriction bypass vulnerability in GNUBoard

From: SSR Team (advisory_at_stgsecurity.com)
Date: 01/03/05

  • Next message: Steve Kudlak: "[Full-Disclosure] Example of Legal Ruling involving Internet Issues: >> Re: Yahoo and inheiriting someone's email"
    To: <vuln@secunia.com>, <news@securiteam.com>, <bugs@securitytracker.com>, <full-disclosure@lists.netsys.com>, <staff@packetstormsecurity.com>
    Date: Mon, 3 Jan 2005 16:16:28 +0900
    
    

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    STG Security Advisory: [SSA-20041224-21] File extensions restriction bypass
    vulnerability in GNUBoard.

    Revision 1.0
    Date Published: 2004-12-24 (KST)
    Last Update: 2005-01-33
    Disclosed by SSR Team (advisory@stgsecurity.com)

    Summary
    ========
    GNUBoard is one of widely used web BBS applications in Korea. However, an
    input validation flaw can cause malicious attackers to run arbitrary
    commands with the privilege of the HTTPD process, which is typically run as
    the nobody user.

    Vulnerability Class
    ===================
    Implementation Error: Input validation flaw

    Impact
    ======
    High : arbitrary command execution.

    Affected Products
    ================
    GNUBoard 3.40 and prior

    Vendor Status: NOT FIXED
    ========================
    2004-12-09 Vulnerability found
    2004-12-09 Vendor contacted and confirmed.
    2005-01-03 Official release.

    Details
    =======
    Implementation of check every file extension of upload files is
    case-sensitive. Bypassing this mechanism, malicious attackers can upload
    arbitrary script files (php, pl, cgi, etc) to a web server.

    gbupdate.php (107 line)
    - ----
    // 실행가능한 스크립트 확장자
    $source = array ("/\.php/", "/\.htm/", "/\.cgi/", "/\.pl/");
    $target = array (".phpx", ".htmx", ".cgix", ".plx");
    - ----

    gbupdate.php (142 line)
    - ----
     // php_x 와 같은 방법으로 스크립트 실행을 하지 못하게 하였으나 abc.php._x
    는 실행되는 버그가 있음
     $filename = preg_replace($source, $target, $filename);
     // 접두사를 붙인 파일명
     $upload[$i] = $prefix . $filename;
     $dest_file = "./data/file/$bo_table/$upload[$i]";
    - ----

    malicious attackers can upload [attack].PHP.rar, [attack].pHp.rar, etc.

    Solution
    =========
    modify 108th line of gbupdate.php as following
    $source = array ("/\.php/i", "/\.htm/i", "/\.cgi/i", "/\.pl/i");

    Vendor URL
    ==========
    http://www.sir.co.kr/

    Credits
    ======
    Jeremy Bae at STG Security

    -----BEGIN PGP SIGNATURE-----
    Version: PGP 8.0

    iQA/AwUBQdjxDD9dVHd/hpsuEQIfQgCdH1I3gYRYQhM49hOOEKg35puXscUAoK07
    zKwL5QKjuY2Nb2yzKAtFwDhJ
    =o+Ui
    -----END PGP SIGNATURE-----

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html


  • Next message: Steve Kudlak: "[Full-Disclosure] Example of Legal Ruling involving Internet Issues: >> Re: Yahoo and inheiriting someone's email"

    Relevant Pages