Multiple vulnerabilities in Piwigo



Advisory ID: HTB23085
Product: Piwigo
Vendor: Piwigo project
Vulnerable Version(s): 2.3.3 and probably prior
Tested Version: 2.3.3
Vendor Notification: 4 April 2012
Vendor Patch: 8 April 2012
Public Disclosure: 25 April 2012
Vulnerability Type: Directory Path Traversal, Cross-Site Scripting (XSS)
CVE Reference(s): CVE-2012-2208, CVE-2012-2209
Solution Status: Fixed by Vendor
Risk Level: Medium
Credit: High-Tech Bridge SA Security Research Lab ( https://www.htbridge.com/advisory/ )

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Piwigo, which can be exploited to perform Cross-Site Scripting (XSS) and Path Traversal attacks.


1) Directory Path Traversal in Piwigo: CVE-2012-2208

1.1 Input passed via the "language" GET parameter to upgrade.php is vulnerable to directory path traversal. The directory path passed to the "language" parameter is later used in include() function to include the following files: common.lang.php, admin.lang.php, install.lang.php and upgrade.lang.php.

Under certain conditions this can be exploited to include malicious PHP file and execute arbitrary PHP code. To exploit this vulnerability the attacker should create a file with the name from the list above (for example admin.lang.php) in the file system (for example in /tmp/) and try to include it via directory traversal.

The following PoC (Proof of Concept) demonstrates the vulnerability:

http://[host]/upgrade.php?language=../../../../../tmp/

/tmp/ directory should contain "admin.lang.php" file that will be used in include() call.


2) Multiple Cross-Site Scripting (XSS) in Piwigo: CVE-2012-2209

2.1 Input passed via the "section" GET parameter to admin.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in administrator's browser session in context of affected website.

The following PoC (Proof of Concept) demonstrates the vulnerability:

http://[host]/admin.php?page=configuration&section=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

2.2 Input passed via the "installstatus" GET parameter to admin.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in administrator's browser session in context of affected website.

The following PoC demonstrates the vulnerability:

http://[host]/admin.php?page=languages_new&installstatus=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

2.3 Input passed via the "theme" GET parameter to admin.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in administrator's browser session in context of affected website.

The following PoC demonstrates the vulnerability:

http://[host]/admin.php?page=theme&theme=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

-----------------------------------------------------------------------------------------------

Solution:

Upgrade to Piwigo 2.3.4

More Information:
http://piwigo.org/forum/viewtopic.php?id=19173
http://piwigo.org/releases/2.3.4
http://piwigo.org/bugs/view.php?id=2607

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23085 - https://www.htbridge.com/advisory/HTB23085 - Multiple vulnerabilities in Piwigo.
[2] Piwigo - http://piwigo.org/ - Piwigo is a photo gallery software for the web, built by an active community of users and developers.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.



Relevant Pages

  • Multiple XSS vulnerabilities in XOOPS
    ... Vendor Notification: 7 December 2011 ... Vulnerability Type: XSS ... This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website. ... The following PoC code is available: ...
    (Bugtraq)
  • Multiple XSS in Fork CMS
    ... Product: Fork CMS ... Vendor Notification: 15 February 2012 ... This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website. ... The following PoC demostrate the vulnerability: ...
    (Bugtraq)
  • Multiple vulnerabilities in OrangeHRM
    ... Vendor: OrangeHRM Inc. ... High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in OrangeHRM, which can be exploited to perform SQL Injection and Cross-Site Scripting attacks. ... Successful exploitation of this vulnerability requires attacker to be registered and logged-in. ... This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website. ...
    (Bugtraq)
  • Multiple XSS in Dotclear
    ... Vendor Notification: 8 February 2012 ... High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Dotclear, which can be exploited to perform Cross-Site Scripting attacks. ... The following PoC demonstrates the vulnerability: ... This can be exploited to execute arbitrary HTML and script code in administrator's browser session in context of affected website. ...
    (Bugtraq)
  • Survey: "MIME/Content-Type-Sniffing" Issues in Image Uploads in Forum Scripts
    ... opening XSS vulnerabilities in software that allows uploads. ... IN a survey, we found myBB, fluxBB, phorum, SMF and WBB to be vulnerable to ... Vendor Reaction ... leading to a cross-site-scripting vulnerability. ...
    (Bugtraq)