SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Forum/Board/Portal)  >   GNUBoard Vendors:   SIR
GNUBoard Case-Sensitive File Extension Validation Lets Remote Users Upload Scripting Files
SecurityTracker Alert ID:  1012753
SecurityTracker URL:  http://securitytracker.com/id/1012753
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Jan 3 2005
Impact:   Execution of arbitrary code via network, Modification of user information, User access via network
Vendor Confirmed:  Yes  
Version(s): 3.40 and prior version
Description:   STG Security reported an input validation vulnerability in GNUBoard. A remote user with file upload privileges can upload arbitrary scripting code to the target system.

The 'gbupdate.php' script does not properly validate the file extensions of uploaded files, performing only a case-sensitive check. A remote user can upload files containing scripting code and having a file extension commonly associated with scripting files (e.g., php, pl, cgi). Then, the remote user can cause the web server to execute the uploaded file.

The vendor was notified on December 9, 2004.

Jeremy Bae at STG Security is credited with discovering this flaw.

Impact:   A remote user with file upload privileges can upload scripting files to the target system and then cause the web server to execute the files.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.sir.co.kr/ (Links to External Site)
Cause:   Access control error, Input validation error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  STG Security Advisory: [SSA-20041224-21] File extensions restriction bypass vulnerability in GNUBoard


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

STG Security Advisory: [SSA-20041224-21] File extensions restriction bypass
vulnerability in GNUBoard.

Revision 1.0
Date Published: 2004-12-24 (KST)
Last Update: 2005-01-33
Disclosed by SSR Team (advisory@stgsecurity.com)


Summary
========
GNUBoard is one of widely used web BBS applications in Korea.  However, an
input validation flaw can cause malicious attackers to run arbitrary
commands with the privilege of the HTTPD process, which is typically run as
the nobody user.



Vulnerability Class
===================
Implementation Error: Input validation flaw

Impact
======
High : arbitrary command execution.

Affected Products
================
GNUBoard 3.40 and prior

Vendor Status: NOT FIXED
========================
2004-12-09 Vulnerability found
2004-12-09 Vendor contacted and confirmed.
2005-01-03 Official release.

Details
=======
Implementation of check every file extension of upload files is
case-sensitive. Bypassing this mechanism, malicious attackers can upload
arbitrary script files (php, pl, cgi, etc) to a web server.

gbupdate.php (107 line)
- ----
// 실행가능한 스크립트 확장자
$source = array ("/\.php/", "/\.htm/", "/\.cgi/", "/\.pl/");
$target = array (".phpx", ".htmx", ".cgix", ".plx");
- ----

gbupdate.php (142 line)
- ----
 // php_x 와 같은 방법으로 스크립트 실행을 하지 못하게 하였으나 abc.php._x
는 실행되는 버그가 있음
 $filename = preg_replace($source, $target, $filename);
 // 접두사를 붙인 파일명
 $upload[$i] = $prefix . $filename;
 $dest_file = "./data/file/$bo_table/$upload[$i]";
- ----

malicious attackers can upload [attack].PHP.rar, [attack].pHp.rar, etc.

Solution
=========
modify 108th line of gbupdate.php as following
$source = array ("/\.php/i", "/\.htm/i", "/\.cgi/i", "/\.pl/i");

Vendor URL
==========
http://www.sir.co.kr/

Credits
======
Jeremy Bae at STG Security

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0

iQA/AwUBQdjxDD9dVHd/hpsuEQIfQgCdH1I3gYRYQhM49hOOEKg35puXscUAoK07
zKwL5QKjuY2Nb2yzKAtFwDhJ
=o+Ui
-----END PGP SIGNATURE-----
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC