iDEFENSE Security Advisory 02.22.05: phpBB Group phpBB2 Arbitrary File Unlink Vulnerability

From: iDEFENSE Labs (labs-no-reply_at_idefense.com)
Date: 02/22/05

  • Next message: Raven: "Software PBLang 4.65 search.php XSS vulnerability"
    Date: Tue, 22 Feb 2005 11:11:19 -0500
    To: <bugtraq@securityfocus.com>, <vulnwatch@vulnwatch.org>
    
    

    phpBB Group phpBB2 Arbitrary File Unlink Vulnerability

    iDEFENSE Security Advisory 02.22.05
    www.idefense.com/application/poi/display?id=205&type=vulnerabilities
    February 22, 2005

    I. BACKGROUND

    phpBB is an open source bulletin board package written in the PHP web
    scripting language. More information about phpBB is available from:

        http://www.phpbb.com/

    II. DESCRIPTION

    Remote exploitation of an input validation vulnerability in the phpBB
    Group's phpBB2 bulletin board system allows attackers to unlink (delete)
    arbitrary system files under the privileges of the web server.

    phpBB is an open-source web-based bulletin board system written in PHP.
    The vulnerability specifically exists due to a combination of several
    flaws that allows a remote attacker to control the arguments in a call
    to unlink().The first flaw occurs in the avatar gallery, where a user is
    permitted to specify part of the directory name for the desired avatar.
    Directory traversal modifies (ex: "/../") are not properly filtered out,
    allowing a user to break out of the default avatar directory. This issue
    is realized in lines 68-71 of usercp_avatar.php:

        if (
    file_exists(@phpbb_realpath($board_config['avatar_gallery_path']
           . '/' . $avatar_filename)) && ($mode == 'editprofile') )
        {
                $return = ", user_avatar = '" . str_replace("/'", "''",
                   $avatar_filename) . "', user_avatar_type = " .
                   USER_AVATAR_GALLERY;
        }

    Avatar's are then composed with the following code excerpt found in line
    90 of usercp_viewprofile.php:

        $avatar_img = ( $board_config['allow_avatar_local'] ) ? '<img src="'

           . $board_config['avatar_gallery_path'] . '/' .
           $profiledata['user_avatar'] . '" alt="" border="0" />' : '';

    The abused calls to unlink() are made when an avatar is deleted. There
    is a guard around these functions requiring that the target avatar to
    unlink exist in the avatar_path. This routine is also vulnerable to a
    directory traversal attack. By issuing a large number of "/../"
    directory traversal modifiers, an attacker is able to delete arbitrary
    system files. The vulnerable segment of code shown here is from lines
    473-478 of usercp_register.php:

        if ( @file_exists(@phpbb_realpath('./' .
    $board_config['avatar_path']
           . '/' . $userdata['user_avatar'])) )
        {
            @unlink(@phpbb_realpath('./' . $board_config['avatar_path'] .
    '/'
            . $userdata['user_avatar']));
        }

    An attacker can exploit this vulnerability by modifying the
    "avatarselect" return value from the gallery to point to the desired
    file to delete. The choice must be submitted twice for the attack to be
    successful.

    III. ANALYSIS

    Exploitation of this vulnerability allows remote attackers to unlink
    arbitrary system files under the privileges of the underlying web
    server. An attacker must have or be able to create an account on the
    target system. Non-default settings must be enabled for exploitation to
    be possible. An attacker can potentially further compromise the target
    system by erasing sensitive files such as .htaccess files that provide
    access control rules.

    IV. DETECTION

    iDEFENSE has confirmed the existence of this vulnerability in phpBB2
    version 2.0.11. It is suspected that earlier versions are affected as
    well. "Enable gallery avatars" must be enabled for the target to be
    vulnerable.

    V. WORKAROUND

    Disable gallery avatars. This can be done through th phpBB
    administrative interface under "General Admin -> Configuration ->
    Avatar Settings".

    VI. VENDOR RESPONSE

    This vulnerability is addressed in phpBB version 2.0.12 available for
    download at:

       http://www.phpbb.com/downloads.php

    VII. CVE INFORMATION

    The Common Vulnerabilities and Exposures (CVE) project has assigned the
    names CAN-2005-0258 to these issues. This is a candidate for inclusion
    in the CVE list (http://cve.mitre.org), which standardizes names for
    security problems.

    VIII. DISCLOSURE TIMELINE

    02/09/2005 Initial vendor notification
    02/11/2005 Initial vendor response
    02/22/2005 Public disclosure

    IX. CREDIT

    AnthraX101 (AnthraX101[at]gmail.com) is credited with this discovery.

    Get paid for vulnerability research
    http://www.idefense.com/poi/teams/vcp.jsp

    Free tools, research and upcoming events
    http://labs.idefense.com

    X. LEGAL NOTICES

    Copyright (c) 2005 iDEFENSE, Inc.

    Permission is granted for the redistribution of this alert
    electronically. It may not be edited in any way without the express
    written consent of iDEFENSE. If you wish to reprint the whole or any
    part of this alert in any other medium other than electronically, please
    email customerservice@idefense.com for permission.

    Disclaimer: The information in the advisory is believed to be accurate
    at the time of publishing based on currently available information. Use
    of the information constitutes acceptance for use in an AS IS condition.

    There are no warranties with regard to this information. Neither the
    author nor the publisher accepts any liability for any direct, indirect,
    or consequential loss or damage arising from use of, or reliance on,
    this information.


  • Next message: Raven: "Software PBLang 4.65 search.php XSS vulnerability"