Advisory: Upload Authorization bypass in CitrusDB

[Maximillian Dornseif <dornseif () informatik rwth-aachen de>]

              Advisory: Upload Authorization bypass in CitrusDB

A group of students at our lab called RedTeam found an authorization  
bypass vulnerability in CitrusDB which results
in upload of fake credit card data, SQL-Injection and disclosure of  
credit card data.

Details
=======

Product: CitrusDB
Affected Version: 0.3.6 (verified), probably <=0.3.6
Immune Version: none (2005-01-30)
OS affected: all
Security-Risk: high
Remote-Exploit: yes
Vendor-URL: http://www.citrusdb.org
Vendor-Status: informed
Advisory-URL:
http://tsyklon.informatik.rwth-aachen.de/redteam/advisories/rt-sa-2005 
-003
Advisory-Status: public
CVE: CAN-2005-0409
(http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0409#)

Introduction
============

Description from vendor:
"CitrusDB is an open source customer database application that uses PHP  
and a
database backend (currently MySQL) to keep track of customer  
information,
services, products, billing, and customer service information."

In the credit card data upload/import scripts it is only checked  
whether or
not a user is logged in but no privilege check is done.

More Details
============

In ./citrusdb/tools/importcc.php and ./citrusdb/tools/uploadcc.php no
authorization is done. Any logged in user (or in combination with
CAN-2005-0408 anybody) may upload a cvs file containing credit card  
data. He
also gets knowledge of the path to the temporary file that stores the
uploaded credit card data and may fetch additional uploaded credit card  
data
(compare CAN-2005-0229) if the file is accessible via http.  
Additionally he
may perform an SQL-Injection (compare CAN-2005-0410).

Proof of Concept
================

This uploads the file exploit.cvs.

curl -D - --cookie "id_hash=2378c7b70e77d9c6737d697a46cbe34b;
user_name=testor" http://<target>/citrusdb/tools/uploadcc.php --form
userfile=@exploit.cvs --form Import=Import

Note: The cookie has to be adjusted to an existing user.

This imports the file to the credit card database:

curl -D - --cookie "id_hash=2378c7b70e77d9c6737d697a46cbe34b;
user_name=testor"
"http://<target>/citrusdb/tools/index.php?load=importcc&submit=on"

Note: The cookie has to be adjusted to an existing user.
No data will be imported if the cvs file is empty, the administrator  
probably
wouldn't notice that the temporary file is now empty but the attacker  
gets
the path to the temporary file and may access data that is uploaded in  
the
future if the path is inside document root (see CAN-2005-0229).
An SQL-Injection is also possible (see CAN-2005-0410)

Workaround
==========

Disable the upload of cvs data, e.g. by setting the path for the  
temporary
cvs file ($path_to_ccfile) to a non-writeable directory.

Fix
===

n/a

Security Risk
=============

The security risk is high because an attacker may corrupt important  
(credit
card) data and an attack is very easy to perform.

History
=======

2005-02-04 Email sent to author
2005-02-12 CVE number requested
2005-02-14 posted as CAN-2005-0409
RedTeam
=======

RedTeam is a penetration testing group working at the Laboratory for
Dependable Distributed Systems at RWTH-Aachen University. You can find  
more
Information on the RedTeam Project at
http://tsyklon.informatik.rwth-aachen.de/redteam/


--
Laboratory for Dependable Distributed Systems, RWTH Aachen University
Get news of the lab at   
http://mail-i4.informatik.rwth-aachen.de/mailman/listinfo/lufgtalk

Attachment: smime.p7s
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html