bugtraq - STG Security Advisory: [SSA-20041224-21] File extensions restriction bypass vulnerability in GNUBoard

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050103074202.4870.qmail@www.securityfocus.com>
Date: 3 Jan 2005 07:42:02 -0000
From: <advisory@...security.com>
To: bugtraq@...urityfocus.com
Subject: STG Security Advisory: [SSA-20041224-21] File extensions
    restriction bypass vulnerability in GNUBoard

STG Security Advisory: [SSA-20041224-21] File extensions restriction bypass
vulnerability in GNUBoard.

Revision 1.0
Date Published: 2004-12-24 (KST)
Last Update: 2005-01-03
Disclosed by SSR Team (advisory@...security.com)

Summary
========
GNUBoard is one of widely used web BBS applications in Korea.  However, an
input validation flaw can cause malicious attackers to run arbitrary
commands with the privilege of the HTTPD process, which is typically run as
the nobody user.

Vulnerability Class
===================
Implementation Error: Input validation flaw

Impact
======
High : arbitrary command execution.

Affected Products
================
GNUBoard 3.40 and prior

Vendor Status: NOT FIXED
========================
2004-12-09 Vulnerability found
2004-12-09 Vendor contacted and confirmed.
2005-01-03 Official release.

Details
=======
Implementation of check every file extension of upload files is
case-sensitive. Bypassing this mechanism, malicious attackers can upload
arbitrary script files (php, pl, cgi, etc) to a web server.

gbupdate.php (107 line)
- ----
// &#49892;&#54665;&#44032;&#45733;&#54620; &#49828;&#53356;&#47549;&#53944; &#54869;&#51109;&#51088;
$source = array ("/\.php/", "/\.htm/", "/\.cgi/", "/\.pl/");
$target = array (".phpx", ".htmx", ".cgix", ".plx");
- ----

gbupdate.php (142 line)
- ----
 // php_x &#50752; &#44057;&#51008; &#48169;&#48277;&#51004;&#47196; &#49828;&#53356;&#47549;&#53944; &#49892;&#54665;&#51012; &#54616;&#51648; &#47803;&#54616;&#44172; &#54616;&#50688;&#51004;&#45208; abc.php._x
&#45716; &#49892;&#54665;&#46104;&#45716; &#48260;&#44536;&#44032; &#51080;&#51020;
 $filename = preg_replace($source, $target, $filename);
 // &#51217;&#46160;&#49324;&#47484; &#48537;&#51064; &#54028;&#51068;&#47749;
 $upload[$i] = $prefix . $filename;
 $dest_file = "./data/file/$bo_table/$upload[$i]";
- ----

malicious attackers can upload [attack].PHP.rar, [attack].pHp.rar, etc.

Solution
=========
modify 108th line of gbupdate.php as following
$source = array ("/\.php/i", "/\.htm/i", "/\.cgi/i", "/\.pl/i");

Vendor URL
==========
http://www.sir.co.kr/

Credits
======
Jeremy Bae at STG Security