bugtraq - Re: [FSA016] ISPConfig 2.2.3, File inclusion vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060616101334.26135.qmail@securityfocus.com>
Date: 16 Jun 2006 10:13:34 -0000
From: t.brehm@...config.org
To: bugtraq@...urityfocus.com
Subject: Re: [FSA016] ISPConfig 2.2.3, File inclusion vulnerability


Thank you for posting your ISPConfig code review.

The posted proof of concept exploit does not affect any ISPConfig installation.

Explanation:

There is one thing that you did not took in account while reviewing the sources:

You reviewed the installation tarball that is not identical with the resulting system after installtion. The file, where the $go_info array is declared that resulted in your errors is created by the installer. ISPCOnfig is not a web application that is run in a normal PHP capable webspace, ISPConfig comes with its own apache webserver and PHP specially compiled and configured for the needs of ISPConfig that prevents the attacks you described.


Your review in detail with the explanation why the files are not affected.

---------------------------------------------------------------
Error occured in server.inc.php, line 35:

include_once($go_info["isp"]["classes_root"] .
$go_info["server"]["dir_trenner"] ."ispconfig_template.lib.php");
---------------------------------------------------------------

- The file server.inc.php is not inside the web root in 
  any ISPConfig installation.

---------------------------------------------------------------
Error occured in app.inc.php, line 48 - 49:

$dbclass = $go_info["server"]["classes_root"] .
$go_info["server"]["dir_trenner"]
."ispconfig_db_".$go_info["server"]["db_type"].".lib.php";
include_once($dbclass);
---------------------------------------------------------------

- The file server.inc.php is not inside the web root in 
  any ISPConfig installation.
- Additionally, the file contains a check in line 31 that
  it is not executed when the file config.inc.php is not
  included, where the $go_info variables are defined.
- Register globals is off in all ISPConfig installations.

---------------------------------------------------------------
Error occured in login.php, line 30 - 31:

$dbclass = $go_info["server"]["classes_root"] .
$go_info["server"]["dir_trenner"]
."ispconfig_db_".$go_info["server"]["db_type"].".lib.php";
include_once($dbclass);
---------------------------------------------------------------

- The file with the variable declaration of the $go_info array is 
  included in line 1.
- Register globals is off in all ISPConfig installations.

---------------------------------------------------------------
Error occured in trylogin.php, line 32 - 33:

$dbclass = $go_info["server"]["classes_root"] .
$go_info["server"]["dir_trenner"]
."ispconfig_db_".$go_info["server"]["db_type"].".lib.php";
include_once($dbclass);
---------------------------------------------------------------

- The file with the variable declaration of the $go_info array is 
  included in line 29.
- Register globals is off in all ISPConfig installations.