full-disclosure - Coppermine Photo Gallery remote compromise

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <001601c2fd25$717f2350$0100a8c0@grotedoos>
From: SkyLined at edup.tudelft.nl (Berend-Jan Wever)
Subject: Coppermine Photo Gallery remote compromise

---AFFECTED SOFTWARE---
>From the website, http://www.chezgreg.net/coppermine/:

"Coppermine Photo Gallery is a picture gallery script. Users can upload
pictures with a web browser (thumbnails are created on the fly), add
comments, send e-cards and view statistics about the pictures. "
"The script use PHP, a MySQL database and the GD library (version 1.x or
2.x) or ImageMagick to make the thumbnails. An install script makes the
installation very fast and easy."

The problem was found in Coppermine 1.0 RC3, the latest stable release. The
latest beta (1.1 beta 2) is not affected according to the author.

---PROMBLEMS---
Coppermine allows the uploading of images onto a server by logged in users
and in a lot of configurations even anonymous uploading. The upload script
has a buggy extention checking routine which allows the uploading of
".jpg.php" files. These files need to be a valid jpg-files or Coppermine
will delete them. It is trivial to create a file which is a valid jpg and
also a valid PHP script. Once uploaded, the PHP script can then be executed,
allowing access to the remote server under the priviledges of the user PHP
is running under.

---EXPLOIT---
Attached is a working exploit, upload this onto a vulnerable server and
execute it like this:
/albums/userpics/Copperminer.jpg.php?[command]
Where command can be something like "id;uname%20-a" or "cat%20/etc/passwd"
Note 1: MSIE will display Copperminer.jpg.php as an image, but lynx will
display the output of the command you gave it.
Note 2: http://www.google.com/search?q=allinurl%3A+/upload.php?album=

---TIMELINE---
mar 31, 2003  - Issue discovered, working exploit written.
mar 31, 2003  - Author contacted, problem aknowledged by author.
apr 05, 2003  - Patches released through Coppermine website.
apr 07, 2003  - Information disclosed.

---PATCH---
Can be found at http://www.chezgreg.net/coppermine/

Kind regards,

Berend-Jan Wever
http://spoor12.edup.tudelft.nl
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Copperminer.jpg.php
Type: application/octet-stream
Size: 5340 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030407/7c70612e/Copperminer.jpg.obj