STG Security Advisory: [SSA-20041224-21] File extensions restriction bypass vulnerability in GNUBoard

2005-01-04T00:00:00
ID SECURITYVULNS:DOC:7486
Type securityvulns
Reporter Securityvulns
Modified 2005-01-04T00:00:00

Description

STG Security Advisory: [SSA-20041224-21] File extensions restriction bypass vulnerability in GNUBoard.

Revision 1.0 Date Published: 2004-12-24 (KST) Last Update: 2005-01-03 Disclosed by SSR Team (advisory@stgsecurity.com)

Summary

GNUBoard is one of widely used web BBS applications in Korea. However, an input validation flaw can cause malicious attackers to run arbitrary commands with the privilege of the HTTPD process, which is typically run as the nobody user.

Vulnerability Class

Implementation Error: Input validation flaw

Impact

High : arbitrary command execution.

Affected Products

GNUBoard 3.40 and prior

Vendor Status: NOT FIXED

2004-12-09 Vulnerability found 2004-12-09 Vendor contacted and confirmed. 2005-01-03 Official release.

Details

Implementation of check every file extension of upload files is case-sensitive. Bypassing this mechanism, malicious attackers can upload arbitrary script files (php, pl, cgi, etc) to a web server.

gbupdate.php (107 line)


// 실행가능한 스크립트 확장자 $source = array ("/\.php/", "/\.htm/", "/\.cgi/", "/\.pl/"); $target = array (".phpx", ".htmx", ".cgix", ".plx");


gbupdate.php (142 line)


// php_x 와 같은 방법으로 스크립트 실행을 하지 못하게 하였으나 abc.php._x 는 실행되는 버그가 있음 $filename = preg_replace($source, $target, $filename); // 접두사를 붙인 파일명 $upload[$i] = $prefix . $filename; $dest_file = "./data/file/$bo_table/$upload[$i]";


malicious attackers can upload [attack].PHP.rar, [attack].pHp.rar, etc.

Solution

modify 108th line of gbupdate.php as following $source = array ("/\.php/i", "/\.htm/i", "/\.cgi/i", "/\.pl/i");

Vendor URL

http://www.sir.co.kr/

Credits

Jeremy Bae at STG Security