full-disclosure - [FD] [KIS-2015-01] Concrete5 <= 5.7.3.1 (sendmail) Remote Code Execution Vulnerability

Open Source and information security mailing list archives

Message-ID: <5579E77E.3020808@karmainsecurity.com>
Date: Thu, 11 Jun 2015 21:54:38 +0200
From: Egidio Romano <research@...mainsecurity.com>
To: bugtraq@...urityfocus.com, fulldisclosure@...lists.org
Subject: [FD] [KIS-2015-01] Concrete5 <= 5.7.3.1 (sendmail) Remote Code
 Execution Vulnerability

-------------------------------------------------------------------
Concrete5 <= 5.7.3.1 (sendmail) Remote Code Execution Vulnerability
-------------------------------------------------------------------

[-] Software Link:

https://www.concrete5.org/

[-] Affected Versions:

Version 5.7.3.1 and probably other versions.

[-] Vulnerability Description:

The vulnerable code is located in /concrete/controllers/single_page/dashboard/system/registration/open.php:

21.	 switch ($this->post('registration_type')) {
22.	    case "enabled":
23.	        Config::save('concrete.user.registration.enabled', true);
24.	        Config::save('concrete.user.registration.validate_email', false);
25.	        Config::save('concrete.user.registration.approval', false);
26.	        Config::save('concrete.user.registration.notification', $this->post('register_notification'));
27.	        Config::save(
28.	            'concrete.user.registration.notification_email',
29.	            Loader::helper('security')->sanitizeString(
30.	                $this->post('register_notification_email')));
31.	        break;

User input passed through the "register_notification_email" POST parameter is not properly sanitized before
being stored into a configuration setting at lines 27-30 (the sanitizeString() method doesn’t check if it is
a valid email address). This value is used as a sender email address to send out a notification email when a
new user is being registered, and this is done using the PHP mail() function, specifically passing such value
to its fifth parameter. So, when sendmail is used to send out such an email, it is possible to alter the
command line and tell the sendmail program to log all the email traffic in an arbitrary file chosen by the
attacker, resulting in an arbitrary PHP code execution. This vulnerability is mitigated by the fact that it
can be exploited only by authenticated administrator users (even though it could be exploited via a Cross-Site
Request Forgery attack as well) and only if the email is being sent with sendmail.

[-] Solution:

Update to version 5.7.4 or later.

[-] Disclosure Timeline:

[05/05/2015] - Vulnerability details sent through HackerOne
[05/05/2015] - Vendor said a patch has been committed and will be available in the next version
[07/05/2015] - Version 5.7.4 released along with the patch for this vulnerability
[06/06/2015] - Vulnerability publicly disclosed on HackerOne
[11/06/2014] - CVE number requested
[11/06/2014] - Publication of this advisory

[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org) has not assigned a name to this vulnerability yet.

[-] Credits:

Vulnerability discovered by Egidio Romano of Minded Security.

[-] Original Advisory:

http://karmainsecurity.com/KIS-2015-01

[-] Other References:

https://hackerone.com/reports/59663

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives