477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
99 lines
3.8 KiB
Text
Executable file
99 lines
3.8 KiB
Text
Executable file
==============================================================================
|
|
TinyBrowser (TinyMCE Editor File browser) 1.41.6 - Multiple Vulnerabilities
|
|
==============================================================================
|
|
|
|
Discovered by
|
|
Aung Khant, YGN Ethical Hacker Group, Myanmar
|
|
http://yehg.net/ ~ believe in full disclosure
|
|
|
|
Advisory URL:
|
|
http://yehg.net/lab/pr0js/advisories/tinybrowser_1416_multiple_vulnerabilities
|
|
Date published: 2009-07-27
|
|
Severity: High
|
|
Vulnerability Class: Abuse of Functionality
|
|
Affected Products:
|
|
- TinyMCE editor with TinyBrowser plugin
|
|
- Any web sites/web applications that use TinyMCE editor with TinyBrowser plugin
|
|
|
|
|
|
Author: Bryn Jones (http://www.lunarvis.com)
|
|
Author Contacted: Yes
|
|
Reply: No reply
|
|
|
|
|
|
Product Overview
|
|
================
|
|
|
|
TinyBrowser is a plugin of TinyMCE JavaScript editor that acts as
|
|
file browser to view, upload, delete, rename files and folders on the
|
|
web servers.
|
|
|
|
|
|
Vulnerabilities
|
|
==================
|
|
|
|
#1. Default Insecure Configurations
|
|
|
|
Configuration settings shipped with tinybrowser are relatively insecure by
|
|
default. They allow attackers to view, upload, delete, rename files and folders
|
|
under its predefined upload directory.
|
|
|
|
Casual web developers or users might just upload the TinyMCE browser without
|
|
doing any configurations or they might do it later.
|
|
Meanwhile, if an attacker luckily finds the tinybrowser directory, which is by default
|
|
jscripts/tiny_mce/plugins/tinybrowser, he can do harm or abuse because of
|
|
insecure default configurations.
|
|
|
|
This was once a vulnerability of fckeditor (http://fckeditor.net) which has fixed
|
|
its hole - if you run fckeditor's file upload page the first time, you'll see
|
|
"This connector is disabled. Please check the ....". Tinybrowser should imitate
|
|
like this.
|
|
|
|
|
|
#2. Arbitrary Folder Creation
|
|
|
|
Requesting the url [PATH]/tinybrowser.php?type=image&folder=hacked will
|
|
create a folder named "hacked" in /useruploads/images/ directory if that
|
|
folder does not exist.
|
|
|
|
|
|
#3. Arbitrary File Hosting
|
|
|
|
File: config_tinybrowser.php
|
|
Code:
|
|
// File upload size limit (0 is unlimited)
|
|
$tinybrowser['maxsize']['image'] = 0; // Image file maximum size
|
|
$tinybrowser['maxsize']['media'] = 0; // Media file maximum size
|
|
$tinybrowser['maxsize']['file'] = 0; // Other file maximum size
|
|
$tinybrowser['prohibited'] = array('php','php3','php4','php5','phtml','asp','aspx','ascx','jsp','cfm','cfc','pl','bat','exe','dll','reg','cgi', 'sh', 'py','asa','asax','config','com','inc');
|
|
// Prohibited file extensions
|
|
|
|
The max allowable upload is not restricted. So it will depend only on web server's default setting or
|
|
PHP timeout value. There are not many restricted file types. Here's a way to abuse:
|
|
- Create a hidden directory by requesting [PATH]/upload.php?type=file&folder=.hostmyfiles
|
|
- Then go to /upload.php?type=file&folder=.hostmyfiles
|
|
- Host your sound, movie, pictures, zipped archives or even your sample HTML web sites for FREE!
|
|
|
|
An evil trick to create seemingly interesting folder such as secret and host a
|
|
browser-exploit html page that triggers drive-by-download trojan.
|
|
When web master browses that folder and clicks the exploit file, then he gets owned.
|
|
|
|
#4. Cross-site Scripting
|
|
|
|
Most GET/POST variables are not sanitized.
|
|
|
|
File: upload.php
|
|
Code:
|
|
$goodqty = (isset($_GET['goodfiles']) ? $_GET['goodfiles'] : 0);
|
|
$badqty = (isset($_GET['badfiles']) ? $_GET['badfiles'] : 0);
|
|
$dupqty = (isset($_GET['dupfiles']) ? $_GET['dupfiles'] : 0);
|
|
|
|
Exploit: upload.php?badfiles=1"><script>alert(/XSS/)</script>
|
|
|
|
#5. Cross-site Request Forgeries
|
|
|
|
All major actions such as create, delete, rename files/folders are GET/POST XSRF-able.
|
|
|
|
#########################################################################################
|
|
|
|
# milw0rm.com [2009-07-28]
|