oss-sec mailing list archives
Re: CVE request: remote code execution in egroupware <= 1.8.005
From: Pedro Ribeiro <pedrib () gmail com>
Date: Wed, 19 Feb 2014 22:17:00 +0000
On 19 February 2014 18:10, Ralf Becker <rb () stylite de> wrote:
Hi, my remarks to your questions as developer of EGroupware and the fixes included in 1.8.006: Am 19.02.14 16:41, schrieb cve-assign () mitre org:I have discovered a remote code execution via php unserialize in egroupware <= 1.8.005.Use CVE-2014-2027.https://github.com/pedrib/PoC/raw/master/egroupware-1.8.005.txt http://www.egroupware.org/changelogSecurity: fixed arbitrary file overwrite and remote code execution reported by Pedro Ribeiro (pedrib () gmail com) of Agile Information SecurityWe could not immediately determine whether the egroupware-1.8.005.txt disclosure means that: Arbitrary file overwrite in __destruct: Remote code execution in __destruct: are both exploitable only as a consequence of unsafe unserialize use.Removing PHP unserialization removes the thread, as all these values got not stored. So passing PHP serialized data to 1.8.006 code only gives an error, as json_unserialize does not understand it.If eliminating the unsafe unserialize use would not completely address those issues, additional CVE IDs may be needed. There are no new CVE assignments yet for possible other issues in the 1.8.006.20140217 changelog entry, such as: CalDAV/Calendar: fixed permanent auth request in iCal, if accountselection is set to "selectbox with groupmembers" and rights granted from group without being a memberThis is NOT security relevant, server-side errors / exceptions cause basic auth requests as a means to show to user something went wrong.SiteMgr: fixed not working anonymous user and using now a random passwordThis is a hardening included in 1.8.005 by no longer using a static password for anonymous user, but setting up a random one during installation time. So I dont think further CVE's are needed. Ralf -- Ralf Becker Director Software Development Stylite AG Morschheimer Strasse 15 | Tel. +49 6352 70629 0 D-67292 Kirchheimbolanden | Fax. +49 6352 70629 30 Email: rb () stylite de www.stylite.de | www.egroupware.org Managing Directors: Andre Keller | Ralf Becker | Gudrun Mueller Chairman of the supervisory board: Prof. Dr. Birger Leon Kropshofer VAT DE214280951 | Registered HRB 31158 Kaiserslautern Germany
As a further comment on this, Egidio Romano has pointed out that the code execution example is not exploitable. However the file deletion issue still is fully exploitable. Egroupware contains lots of classes with magic methods, some of which might be exploitable (I haven't tested them all). Therefore I am changing this to a POSSIBLE remote code execution instead of a definite code execution. Thanks to Egidio for pointing it out and validating my advisory. I've updated the advisory in the repository. Regards, Pedro
Current thread:
- CVE request: remote code execution in egroupware <= 1.8.005 Pedro Ribeiro (Feb 19)
- Re: CVE request: remote code execution in egroupware <= 1.8.005 cve-assign (Feb 19)
- Re: CVE request: remote code execution in egroupware <= 1.8.005 Ralf Becker (Feb 19)
- Re: CVE request: remote code execution in egroupware <= 1.8.005 Pedro Ribeiro (Feb 19)
- Re: CVE request: remote code execution in egroupware <= 1.8.005 Ralf Becker (Feb 19)
- Re: CVE request: remote code execution in egroupware <= 1.8.005 cve-assign (Feb 19)