lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <54E38103.1030705@lexsi.com> Date: Tue, 17 Feb 2015 18:57:23 +0100 From: Stiehl <pstiehl@...si.com> To: <fulldisclosure@...lists.org> Subject: [FD] [CVE-REQUEST] Multiple vulnerabilities on GLPI Multiple vulnerabilities have been identified in GLPI (http://www.glpi-project.org). 1/ Arbitrary file upload Severity: Important Versions Affected =========== All versions between 0.85 and 0.85.2 Description ======= When an user wants to create a new ticket, he has the possibility to add an attachment. If for example he wants to add a file named "test.php" with or without adding the ticket, the file will be temporary uploaded to GLPI_ROOT/files/_tmp/test.php. We can then directly access this file through http://host/GLPI_ROOT/files/_tmp/test.php and by default the php code will be interpreted. To trigger this vulnerability we need an account that disposes of the rights to create a ticket. This vulnerability is a combination of three issues: - predictable uploaded file names (not randomized) - upload of unauthorized file extensions - temporary uploaded files not deleted if using an unauthorized file extension. Impact ===== By uploading a php file that will be interpreted a malicious user would be able to execute arbitrary code on the server. Mitigation ====== Upgrade to GLPI 0.85.3 (https://forge.indepnet.net/issues/5217) ========== 2/ Privilege escalation Severity: Important Versions Affected =========== All versions <= 0.85.2 Description ======= Taking the default account tech, he is only allowed to add users in the following groups: Self-Service, Technician. He has not the right over, for example, the super-admin group. So he cannot add the super-admin privileges to an existing user. The problem is when creating a new user. When intercepting the POST request (GLPI_ROOT/front/user.form.php) of a user creation and modifying the _profiles_id parameter (corresponding to the group attached to the user) to 4, the new user will have the super-admin privileges. Impact ===== Any user who has the rights to create a new user can create a super-admin user. Mitigation ====== Upgrade to GLPI 0.85.3 (https://forge.indepnet.net/issues/5218) Regards, -- Peter STIEHL _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists