lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 17 Mar 2021 14:22:10 +0100
From: riccardo krauter <riccardo.krauter@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] MS Made Simple - File upload bypass with .phar extension lead
	to RCE

1) Summary

Affected software  CMS Made Simple-2.2.15
Vendor URLhttp://www.cmsmadesimple.org/  <http://www.cmsmadesimple.org/>
Vulnerability	   File upload bypass with .phar extension lead to RCE

2) Vulnerability Description

The vulnerability affect the `FilePicker` module,
it is possible to bypass the restriction and upload a malicious file with `.phar` extension to gain Remote Code Execution.
This vulnerability is remotely exploitable and require authentication.
  
3) PoC and details

* Login into the admin area and surf to the `MicroTiny WYSIWYG editor` functionality then click on the insert/edit image button
* A new window will be opened, now click on the search button, the `CMSMS File Picker` will be shown
* Click on the upload button and Select the .phar file
* Surf to uploads/your-file-name.phar and enjoy the shell

The exploit is working because the upload handler checks only if the extension contains the `php` string (obviously `phar` does not match).
The exploit works fine on a standard Ubuntu system, here the configuration used for the tests:

* Linux ubuntu 5.4.0-58-generic
* php version 7.4.3
* Apache/2.4.41 (Ubuntu)
* File Picker version = "1.0.5"
* CMS Made Simple-2.2.15

More details here: https://github.com/beerpwn/CVE/blob/master/cms_made_simple_2021/file_upload_RCE/File_upload_to_RCE.md

4) Credits

This vulnerability has been discovered and reported
by Riccardo Krauter researcher @ Soter IT Security (soteritsecurity.com).

5) Timeline

2021/02/26  Vendor was informed
2021/02/26  Vendor said he won't fix
2021/03/17  Public disclosure


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists