LibrettoCMS 2.2.2 Malicious File Upload Vulnerability

# Exploit Title   : LibrettoCMS 2.2.2 Malicious File Upload
# Date            : 14 June 2013
# Exploit Author  : CWH Underground
# Site            : www.2600.in.th
# Vendor Homepage : http://libretto.artwebonline.com/
# Software Link   : http://jaist.dl.sourceforge.net/project/librettocms/librettoCMS_v.2.2.2.zip
# Version         : 2.2.2
# Tested on       : Window and Linux
 
  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /         
  / XXXXXX /
 (________(           
  `------'
 
 
#####################################################
VULNERABILITY: File Upload
##################################################### 
 
/adm/ui/js/ckeditor/plugins/pgrfilemanager/myconfig.php (LINE: 50-66)

-----------------------------------------------------------------------------
PGRFileManagerConfig::$fileMaxSize = 1024 * 1024 * 10;
//Allowed file extensions
//PGRFileManagerConfig::$allowedExtensions = '' means all files
PGRFileManagerConfig::$allowedExtensions = 'doc|pdf';
//Allowed image extensions
PGRFileManagerConfig::$imagesExtensions = 'jpg|gif|jpeg|png|bmp';
//Max image file height in px
PGRFileManagerConfig::$imageMaxHeight = 724;
//Max image file width in px
PGRFileManagerConfig::$imageMaxWidth = 1280;
//Thanks to Cycle.cz
//Allow or disallow edit, delete, move, upload, rename files and folders
PGRFileManagerConfig::$allowEdit = true;		// true - false
//Autorization
PGRFileManagerConfig::$authorize = false;        // true - false
PGRFileManagerConfig::$authorizeUser = 'user';
PGRFileManagerConfig::$authorizePass = 'password';
----------------------------------------------------------------------------- 

/adm/ui/js/ckeditor/plugins/pgrfilemanager/php/file.php (LINE: 97-115)

----------------------------------------------------------------------------- 
 else if (($fun === 'renameFile') && (isset($_POST['filename'])) && (isset($_POST['newFilename']))) {
        
        $filename = basename($_POST['filename']);
        $newFilename = basename($_POST['newFilename']);
        
        //allowed chars
        if(preg_match("/^[.A-Z0-9_ [email protected]#$%^&()+={}\\[\\]\\',~`-]+$/i", $newFilename) === 0) die();
        
        $fileLength = strlen($newFilename);
        if($fileLength === 0) die();
        if($fileLength > 200) die();
                
        $file = realpath($directory . '/' . $filename);
        $newFile = $directory . '/' . $newFilename;
        //check if file is in dir
        if(dirname($file) !== $directory) die();
        if(file_exists($file) && !file_exists($newFile)) {
            rename($file, $newFile);
        }
----------------------------------------------------------------------------- 
 
#####################################################
DESCRIPTION
#####################################################
 
LibrettoCMS is provided a file upload function to unauthenticated users. Allows for write/read/edit/delete download arbitrary file uploaded , which results attacker might arbitrary write/read/edit/delete files and folders.

LibrettoCMS use pgrfilemanager and restrict file type for upload (Default file types are *.doc and *.pdf) but able to rename file type after uploaded lead attacker to rename *.doc to *.php and arbitrary execute PHP shell on webserver.
 
#####################################################
EXPLOIT POC
#####################################################
 
1. Access http://target/librettoCMS/adm/ui/js/ckeditor/plugins/pgrfilemanager/PGRFileManager.php 
2. Upload PHP Shell with *.doc format (shell.doc) to PGRFileManager
3. Rename file from shell.doc to shell.php
4. Your renamed file disappeared !!
5. For access shell, http://target/librettoCMS/userfiles/shell.php
6. Server Compromised !!
 
################################################################################################################
 Greetz      : ZeQ3uL, JabAv0C, p3lo, Sh0ck, BAD $ectors, Snapter, Conan, Win7dos, Gdiupo, GnuKDE, JK, Retool2
################################################################################################################

#  0day.today [2018-01-02]  #