phpBB Group phpBB2 Arbitrary File Unlink Vulnerability

iDEFENSE Security Advisory 02.22.05
www.idefense.com/application/poi/display?id=205&type=vulnerabilities
February 22, 2005

I. BACKGROUND

phpBB is an open source bulletin board package written in the PHP web
scripting language. More information about phpBB is available from:

    http://www.phpbb.com/

II. DESCRIPTION

Remote exploitation of an input validation vulnerability in the phpBB
Group's phpBB2 bulletin board system allows attackers to unlink (delete)
arbitrary system files under the privileges of the web server.

phpBB is an open-source web-based bulletin board system written in PHP.
The vulnerability specifically exists due to a combination of several
flaws that allows a remote attacker to control the arguments in a call
to unlink().The first flaw occurs in the avatar gallery, where a user is
permitted to specify part of the directory name for the desired avatar.
Directory traversal modifies (ex: "/../") are not properly filtered out,
allowing a user to break out of the default avatar directory. This issue
is realized in lines 68-71 of usercp_avatar.php:

    if (
file_exists(@phpbb_realpath($board_config['avatar_gallery_path'] 
       . '/' . $avatar_filename)) && ($mode == 'editprofile') )
    {
            $return = ", user_avatar = '" . str_replace("/'", "''", 
               $avatar_filename) . "', user_avatar_type = " . 
               USER_AVATAR_GALLERY;
    }

Avatar's are then composed with the following code excerpt found in line
90 of usercp_viewprofile.php:

    $avatar_img = ( $board_config['allow_avatar_local'] ) ? '<img src="'

       . $board_config['avatar_gallery_path'] . '/' . 
       $profiledata['user_avatar'] . '" alt="" border="0" />' : '';

The abused calls to unlink() are made when an avatar is deleted. There
is a guard around these functions requiring that the target avatar to
unlink exist in the avatar_path. This routine is also vulnerable to a
directory traversal attack. By issuing a large number of "/../"
directory traversal modifiers, an attacker is able to delete arbitrary
system files. The vulnerable segment of code shown here is from lines
473-478 of usercp_register.php:

    if ( @file_exists(@phpbb_realpath('./' .
$board_config['avatar_path'] 
       . '/' . $userdata['user_avatar'])) )
    {
        @unlink(@phpbb_realpath('./' . $board_config['avatar_path'] .
'/' 
        . $userdata['user_avatar']));
    }

An attacker can exploit this vulnerability by modifying the
"avatarselect" return value from the gallery to point to the desired
file to delete. The choice must be submitted twice for the attack to be
successful.

III. ANALYSIS

Exploitation of this vulnerability allows remote attackers to unlink
arbitrary system files under the privileges of the underlying web
server. An attacker must have or be able to create an account on the
target system. Non-default settings must be enabled for exploitation to
be possible. An attacker can potentially further compromise the target
system by erasing sensitive files such as .htaccess files that provide
access control rules.

IV. DETECTION

iDEFENSE has confirmed the existence of this vulnerability in phpBB2
version 2.0.11. It is suspected that earlier versions are affected as
well. "Enable gallery avatars" must be enabled for the target to be
vulnerable.

V. WORKAROUND

Disable gallery avatars. This can be done through th phpBB
administrative interface under "General Admin -> Configuration ->
Avatar Settings".

VI. VENDOR RESPONSE

This vulnerability is addressed in phpBB version 2.0.12 available for
download at:

   http://www.phpbb.com/downloads.php

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the
names CAN-2005-0258 to these issues. This is a candidate for inclusion
in the CVE list (http://cve.mitre.org), which standardizes names for
security problems.

VIII. DISCLOSURE TIMELINE

02/09/2005      Initial vendor notification
02/11/2005      Initial vendor response
02/22/2005      Public disclosure

IX. CREDIT

AnthraX101 (AnthraX101[at]gmail.com) is credited with this discovery.

Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp

Free tools, research and upcoming events
http://labs.idefense.com

X. LEGAL NOTICES

Copyright (c) 2005 iDEFENSE, Inc.

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.

There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.