Arbitrary File Upload/Execution in Collabtive

[Mark Hoopes <xync () xync org>]

This disclosure was posted to Bugtraq yesterday 
(http://www.securityfocus.com/archive/1/522973/30/0/threaded).  I am 
submitting it to oss-security as a request to have a CVE ID assigned.

TITLE: Arbitrary File Upload/Execution in Collabtive
DATE: 06-04-2012
PRODUCT: Collabtive Web-Based Project Management Software 
(http://collabtive.o-dyn.de/)
VERSIONS: 0.7.5, 0.6.1 confirmed.  All versions <= 0.7.5 probable
RESEARCHER: Mark Hoopes (xync () xync org/)
ADDITIONAL INFORMATION: 
http://xync.org/2012/06/04/Arbitrary-File-Upload-in-Collabtive.html

Vulnerability:
During the upload of an avatar image for a Collabtive user, the 
manageuser.php script checks the file type using the MIME type provided 
in the POST request (via the $_FILES['userfile']['type'] variable) 
rather than by extension.  This MIME type can be spoofed via an 
intercepting proxy or custom POST script allowing a malicious user to 
upload an arbitrary file.  This file will be placed in a predictable web 
accessible path with an easily determined name.  In most installations, 
execution from this directory is not restricted which allows a remote 
attacker to execute a PHP script uploaded this way with the privileges 
of the web user.

Access to the avatar upload function is restricted to logged in users, 
but because of Collabtive's design decisions in implementing OpenID 
support, this is easily accomplished.  If an unknown user supplies a 
valid OpenID v1.0 URL as the username on the login page, Collabtive will 
automatically create a new user based on the referenced credentials.  
That new user is not authorized to access any projects, but is 
authorized to upload an avatar image.  This allows an attacker with no 
other knowledge of the host site or its users to exploit the vulnerability.

Fix:
Upgrade to Collabtive v0.7.6 or greater
Source: 
http://sourceforge.net/projects/collabtive/files/collabtive/0.7.6/collabtive076.zip/download
Release Notes: http://www.collabtive.o-dyn.de/blog/?p=426

Workaround:
Disable script execution of the upload directory via .htaccess for 
Apache or similar web servers.  This should apply at minimum to the 
/files/[template]/avatar directory but can safely be applied to the 
entire /files directory.

Sample contents of the .htaccess file are:
  Options -Indexes
  Options -ExecCGI
  AddHandler cgi-script .php .php3 .php4 .phtml .pl .py .jsp .asp .htm 
.shtml .sh .cgi

Note 'AllowOverride Options AddHandler' or 'AllowOverride All' must be 
enabled in the main httpd.conf file for this directory or inherited from 
a parent directory.
See http://www.mysql-apache-php.com/fileupload-security.htm

Additional References:
http://xync.org/2012/06/04/Arbitrary-File-Upload-in-Collabtive.html

http://www.php.net/manual/en/features.file-upload.post-method.php see 
comments for $_FILES['userfile']['type']


TIMELINE:
  April 18, 2012 - Issue reported to developers
  April 19, 2012 - Fix committed to Collabtive github
  May 30,  2012 - Collabtive version 0.7.6 released w/ fix
  June 4, 2012 - Vulnerability published