[VulnWatch] Webfroot Shoutbox 2.32 directory traversal and code injection.

From: pokleyzz (pokleyzz_at_scan-associates.net)
Date: 05/29/03

  • Next message: scheidell_at_secnap.net: "[VulnWatch] SECNAP Security Advisory: Invalid HTML processing in GoldMine(tm)"
    Date: Thu, 29 May 2003 11:52:54 +0800
    To: vulnwatch@vulnwatch.org, bugtraq@securityfocus.com
    
    
    

    Products: Webfroot Shoutbox v 2.32 and below (http://shoutbox.sf.net)
    Date: 09 May 2003
    Author: pokleyzz <pokleyzz_at_scan-associates.net>
    Contributors: sk_at_scan-associates.net
                    shaharil_at_scan-associates.net
                    munir_at_scan-associates.net
    URL: http://www.scan-associates.net

    Summary: Webfroot Shoutbox 2.32 and below directory traversal and code injection.

    Description
    ===========
    Webfroot Shoutbox is PHP script released under the GPL. Also known as a tagboard
    or a blabbox, shoutboxes allow visitors to your website to leave messages to
    other visitors quickly and easily.

    Details
    =======
    User can view any readable file on system where webfroot shoutbox is running using
    $conf variable.

    i) Shoutbox v2.32

    shoutbox.php line 43
    -------------------------------------------------------------------
    if (!isset($conf)) {
       $conf="shoutboxconf.php";
    } else {
       # michel v was there
       $conf = str_replace(':', '', $conf); // hi cross-site scripting, bye cross-site scripting
       $conf = str_replace('%3a', '', $conf); // hi cross-site scripting, bye cross-site scripting
    }

    require_once ($conf);
    -------------------------------------------------------------------

    ii) Shoutbox v2.31

    shoutbox.php line 43
    -------------------------------------------------------------------
    if (!isset($conf)) {
       $conf="shoutboxconf.php";
    }

    require_once ($conf);
    --------------------------------------------------------------------

    Proof of concept
    ================

    a) View any readable file
            http://blablabla.com/shoutbox.php?conf=../../../../../../../etc/passwd

    b) Remote command execution
            i) for version 2.31 user can remotely include file.
            ii) version 2.32 user can use apache access_log to include php code
                    [see attachment]
        

    Workaround
    ==========
    Append to line 48 of shoutbox.php
            $conf = str_replace('./', '', $conf); // to avoid directory traversal

    Tips
    ====
    Search for ":: Shoutbox" at www.google.com can easily identify vulnerable site (129,000 result)

    
    



  • Next message: scheidell_at_secnap.net: "[VulnWatch] SECNAP Security Advisory: Invalid HTML processing in GoldMine(tm)"