Bitweaver R2 CMS Remote File Upload / Disclosure Vulnerabilities

🗓️ 31 Dec 2007 00:00:00Reported by RootType
Bitweaver R2 CMS vulnerabilities - file upload and source code disclosur

                                                ##########################&nbsp;WwW.BugReport.ir&nbsp;#########################
#
#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;AmnPardaz&nbsp;Security&nbsp;Research&nbsp;Team
#
#&nbsp;Title:&nbsp;Bitweaver&nbsp;R2&nbsp;CMS
#&nbsp;Vendor:&nbsp;http://www.bitweaver.org
#&nbsp;Bugs:&nbsp;source&nbsp;code&nbsp;disclosure,&nbsp;arbitrary&nbsp;file&nbsp;upload
#&nbsp;Vulnerable&nbsp;Version:&nbsp;2&nbsp;(prior&nbsp;versions&nbsp;also&nbsp;may&nbsp;be&nbsp;affected)
#&nbsp;Exploitation:&nbsp;Remote&nbsp;with&nbsp;browser
#&nbsp;Fix&nbsp;Available:&nbsp;No!
################################################################


####################
-&nbsp;Description:
####################

Bitweaver&nbsp;is&nbsp;an&nbsp;open&nbsp;source&nbsp;content&nbsp;management&nbsp;system.&nbsp;Its&nbsp;speed&nbsp;and&nbsp;power&nbsp;are&nbsp;ideal&nbsp;for&nbsp;large-scale&nbsp;community&nbsp;websites&nbsp;and&nbsp;corporate&nbsp;applications,&nbsp;but&nbsp;it&nbsp;is&nbsp;simple&nbsp;enough&nbsp;for&nbsp;non-technical&nbsp;small&nbsp;site&nbsp;users&nbsp;to&nbsp;set&nbsp;up&nbsp;and&nbsp;administrate.

####################
-&nbsp;Vulnerability:
####################

+--&gt;&nbsp;arbitrary&nbsp;file&nbsp;upload

Code&nbsp;Snippet:

/fisheye/upload.php&nbsp;line#32-45

	$i&nbsp;=&nbsp;0;
	foreach(&nbsp;array_keys(&nbsp;$_FILES&nbsp;)&nbsp;as&nbsp;$key&nbsp;)&nbsp;{
		if(&nbsp;preg_match(&nbsp;'/(^image|pdf)/i',&nbsp;$_FILES[$key]['type']&nbsp;)&nbsp;)&nbsp;{
			$upImages[$key]&nbsp;=&nbsp;$_FILES[$key];
			if(&nbsp;!empty(&nbsp;$_REQUEST['imagedata'][$i]&nbsp;)&nbsp;)&nbsp;{
				$upData[$key]&nbsp;=&nbsp;$_REQUEST['imagedata'][$i];
			}&nbsp;else&nbsp;{
				$upData[$key]&nbsp;=&nbsp;array();
			}
		}&nbsp;elseif(&nbsp;!empty(&nbsp;$_FILES[$key]['tmp_name']&nbsp;)&nbsp;&amp;&amp;&nbsp;!empty(&nbsp;$_FILES[$key]['name']&nbsp;)&nbsp;)&nbsp;{
			$upArchives[$key]&nbsp;=&nbsp;$_FILES[$key];
		}
		$i++;
	}

It's&nbsp;possible&nbsp;to&nbsp;upload&nbsp;arbitrary&nbsp;files&nbsp;with&nbsp;image/gif&nbsp;content-type&nbsp;(this&nbsp;can&nbsp;be&nbsp;changed&nbsp;via&nbsp;local&nbsp;proxy&nbsp;or&nbsp;direct&nbsp;content&nbsp;altertion)
also&nbsp;its&nbsp;possible&nbsp;for&nbsp;an&nbsp;attacker&nbsp;to&nbsp;bypass&nbsp;&quot;/storage/.htaccess&quot;&nbsp;restriction&nbsp;by&nbsp;uploadding&nbsp;his&nbsp;own&nbsp;.htaccess&nbsp;and&nbsp;control&nbsp;server&nbsp;settings.


+--&gt;source&nbsp;code&nbsp;disclosure

Code&nbsp;Snippet:

/wiki/edit.php&nbsp;line#179-195

if(&nbsp;isset(&nbsp;$_REQUEST[&quot;suck_url&quot;]&nbsp;)&nbsp;)&nbsp;{
	//&nbsp;Suck&nbsp;another&nbsp;page&nbsp;and&nbsp;append&nbsp;to&nbsp;the&nbsp;end&nbsp;of&nbsp;current
	require_once(&nbsp;UTIL_PKG_PATH.'htmlparser/html_parser_inc.php'&nbsp;);
	$suck_url&nbsp;=&nbsp;isset(&nbsp;$_REQUEST[&quot;suck_url&quot;]&nbsp;)&nbsp;?&nbsp;$_REQUEST[&quot;suck_url&quot;]&nbsp;:&nbsp;'';
	$parsehtml&nbsp;=&nbsp;isset(&nbsp;$_REQUEST[&quot;parsehtml&quot;]&nbsp;)&nbsp;?&nbsp;(&nbsp;$_REQUEST[&quot;parsehtml&quot;]&nbsp;==&nbsp;'on'&nbsp;?&nbsp;'y'&nbsp;:&nbsp;'n'&nbsp;):&nbsp;'n';
	if(&nbsp;isset(&nbsp;$_REQUEST['do_suck']&nbsp;)&nbsp;&amp;&amp;&nbsp;strlen(&nbsp;$suck_url&nbsp;)&nbsp;&gt;&nbsp;0&nbsp;)&nbsp;{
		.
		.
		.
		$sdta&nbsp;=&nbsp;@file_get_contents(&nbsp;$suck_url&nbsp;);

POC:&nbsp;http://localhost/bitweaver/wiki/edit.php?page=SandBox&amp;suck_url=./../kernel/config_inc.php&amp;do_suck=h

####################
-&nbsp;Credit&nbsp;:
####################
Original&nbsp;Advisory:http://www.bugreport.ir/?/24
AmnPardaz&nbsp;Security&nbsp;Research&nbsp;Team
Contact:&nbsp;admin[4t}bugreport{d0t]ir
WwW.BugReport.ir
WwW.AmnPardaz.com
31 Dec 2007 00:00Current
7.1High risk
Vulners AI Score7.1