phpBB Group phpBB Arbitrary File Disclosure Vulnerability iDEFENSE Security Advisory 02.22.05 www.idefense.com/application/poi/display?id=204&type=vulnerabilities February 22, 2005 I. BACKGROUND phpBB is an open source bulletin board package written in the PHP web scripting language. More information about phpBB is available from: http://www.phpbb.com/ II. DESCRIPTION Remote exploitation of an input validation vulnerability in the phpBB Group's phpBB2 bulletin board system allows attackers to read the contents of arbitrary system files under the privileges of the web server. phpBB is an open-source web-based bulletin board system written in PHP. The problem specifically exists due to an input validation error that allows a remote attacker to control the arguments in a call to copy(). When a user requests to upload an avatar, the variable '$user_avatar_upload' defaults to uploading from a remote URL and the variable '$avatar_mode' defaults to uploading from the local computer. The variable '$user_avatar_upload' contains either the remote URL or the temporary server name depending on whether the source of the avatar to upload is local or remote. In the event that both a local and remote upload are requested simultaneously, the temporary upload location is substituted with the remote server name. This will later be copied to the new location. By submitting a local path rather then a URL, an attacker is able to execute an arbitrary copy() command. An attacker can exploit this input validation condition by selecting an avatar from the local machine that meets the board guidelines and can then fill the "Upload Avatar from a URL:" field with the path to an arbitrary file (ex: /etc/passwd). When the avatar is submitted, the destination image of the submitted avatar will contain the contents of the requested file. III. ANALYSIS Exploitation of this vulnerability allows remote attackers to view arbitrary system files under the privileges of the underlying web server. An attacker must have, or be able to create an account on the target system. Non-default settings must also be enabled for exploitation to be possible. Upon successful exploitation an attacker may be able to further compromise the system by gleaning system information that would otherwise be inaccessible to the attacker. IV. DETECTION iDEFENSE has confirmed the existence of this vulnerability in phpBB2 version 2.0.11. It is suspected that earlier versions are affected as well. "Enable remote avatars" and "Enable avatar uploading" must be enabled for the target to be vulnerable. V. WORKAROUND Disable remote avatars and remove avatar uploading. This can be done through th phpBB administrative interface under "General Admin -> Configuration -> Avatar Settings". Alternatively, enable the 'open_basedir' PHP security directive to lock file I/O operations to a specific directory. VI. VENDOR RESPONSE This vulnerability is addressed in phpBB version 2.0.12 available for download at: http://www.phpbb.com/downloads.php VII. CVE INFORMATION The Common Vulnerabilities and Exposures (CVE) project has assigned the names CAN-2005-0259 to these issues. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. VIII. DISCLOSURE TIMELINE 02/09/2005 Initial vendor notification 02/11/2005 Initial vendor response 02/22/2005 Public disclosure IX. CREDIT AnthraX101 (AnthraX101[at]gmail.com) is credited with this discovery. Get paid for vulnerability research http://www.idefense.com/poi/teams/vcp.jsp Free tools, research and upcoming events http://labs.idefense.com X. LEGAL NOTICES Copyright (c) 2005 iDEFENSE, Inc. Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDEFENSE. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email customerservice@idefense.com for permission. Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.