eyeOS089.txt

`##########################################################  
# GulfTech Security Research February 7, 2006  
##########################################################  
# Vendor : eyeOS Project  
# URL : http://www.eyeos.org/  
# Version : eyeOS <= 0.8.9  
# Risk : Remote Code Execution  
##########################################################  
  
  
  
Description:  
eyeOS is a "web based operating system" written in php, that  
lets you access your data and your applications from anywhere  
with an internet connection. There is a very easy to exploit  
Remote Code Execution issue in one of the core eyeOS files  
that affects eyeOS 0.8.9 and earlier. A new version of eyeOS  
has been released and all users should upgrade immediately.  
  
  
  
Remote Code Execution:  
There is a Remote Code Execution vulnerability in eyeOS that  
is the result of improperly initializing users sessions.  
  
if (!isset ($_SESSION))  
session_start ();  
  
The above code is taken from desktop.php @ lines 20-21 and is  
the reason code execution is possible. The $_SESSION array is  
like any other variable until initialized with session_start()  
unless session.auto_start is set to 1. What's even worse is that  
obviously an attacker does not have to authenticate in order to  
exploit this issue, which makes it much more dangerous.  
  
http://eyeOS/desktop.php?baccio=eyeOptions.eyeapp&a=eyeOptions.eyeapp  
&_SESSION[usr]=root&_SESSION[apps][eyeOptions.eyeapp][wrapup]=phpinfo();  
  
The above url will successfully execute the phpinfo() command  
on the target webserver with privileges of the webserver.  
  
  
  
Solution:  
A new version of eyeOS (eyeOS v0.8.10) is now available at the  
official eyeOS website. Users are encouraged to upgrade as soon  
as possible.  
  
  
  
Related Info:  
The original advisory can be found at the following location  
http://www.gulftech.org/?node=research&article_id=00096-02072006  
  
  
`