full-disclosure - Executing arbitrary PHP code on OpenX <= 2.8.1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <4B0BBD3A.4060802@moritz-naumann.com>
Date: Tue, 24 Nov 2009 12:02:18 +0100
From: Moritz Naumann <security@...itz-naumann.com>
To: Full Disclosure <full-disclosure@...ts.grok.org.uk>, 
	bugtraq@...urityfocus.com
Subject: Executing arbitrary PHP code on OpenX <= 2.8.1

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hi,

OpenX adserver version 2.8.1 and lower is vulnerable to remote code
execution. To be exploited, this vulnerability requires banner / file
upload permissions, such as granted to the 'advertiser' and
'administrator' roles.

This vulnerability is caused by the (insecure) file upload mechanism of
affected OpenX versions. These would check magic bytes of an uploaded
file to determine its MIME type, and erroneously assume this
information to be reliable. Additionally, while the file name of
uploaded files is changed, the file extension is not.

As such, it is possible to upload image files with embedded PHP code and
.php file extension. Unless PHP script execution is explicitly prevented
for the file upload location (which has not been documented in the OpenX
manual so far and it is not the result of a default installation), the
PHP code will execute as soon as HTTP access to the file location will
cause it to be executed by the web server.

To clarify, an attacker exploiting this security issue does require
prior access to OpenX, i.e. exploitation is only possible after
successful authentication. On the other hand, advertiser access is a
rather low permission level and should not allow for system access.

If these bugs were not hidden from OpenX' bug tracker, you could read up
more about issue X-5747 here:
https://developer.openx.org/jira/browse/OX/fixforversion/10910

OpenX 2.8.2 has already been released in October to fix this issue and
can be downloaded from
http://www.openx.org/ad-server/download

Moritz Naumann
Naumann IT Security Consulting
Berlin, Germany

http://www.moritz-naumann.com/

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEAREKAAYFAksLvToACgkQn6GkvSd/BgxufgCfb27dD4mvPfnOa6YEthKNRzrm
C7YAnieGtdnqtzBO28zThXHHy/WnCeHG
=3R3Y
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/