phpBB Group phpBB2 Arbitrary File Unlink Vulnerability iDEFENSE Security Advisory 02.22.05 www.idefense.com/application/poi/display?id=205&type=vulnerabilities February 22, 2005 I. BACKGROUND phpBB is an open source bulletin board package written in the PHP web scripting language. More information about phpBB is available from: http://www.phpbb.com/ II. DESCRIPTION Remote exploitation of an input validation vulnerability in the phpBB Group's phpBB2 bulletin board system allows attackers to unlink (delete) arbitrary system files under the privileges of the web server. phpBB is an open-source web-based bulletin board system written in PHP. The vulnerability specifically exists due to a combination of several flaws that allows a remote attacker to control the arguments in a call to unlink().The first flaw occurs in the avatar gallery, where a user is permitted to specify part of the directory name for the desired avatar. Directory traversal modifies (ex: "/../") are not properly filtered out, allowing a user to break out of the default avatar directory. This issue is realized in lines 68-71 of usercp_avatar.php: if ( file_exists(@phpbb_realpath($board_config['avatar_gallery_path'] . '/' . $avatar_filename)) && ($mode == 'editprofile') ) { $return = ", user_avatar = '" . str_replace("/'", "''", $avatar_filename) . "', user_avatar_type = " . USER_AVATAR_GALLERY; } Avatar's are then composed with the following code excerpt found in line 90 of usercp_viewprofile.php: $avatar_img = ( $board_config['allow_avatar_local'] ) ? '' : ''; The abused calls to unlink() are made when an avatar is deleted. There is a guard around these functions requiring that the target avatar to unlink exist in the avatar_path. This routine is also vulnerable to a directory traversal attack. By issuing a large number of "/../" directory traversal modifiers, an attacker is able to delete arbitrary system files. The vulnerable segment of code shown here is from lines 473-478 of usercp_register.php: if ( @file_exists(@phpbb_realpath('./' . $board_config['avatar_path'] . '/' . $userdata['user_avatar'])) ) { @unlink(@phpbb_realpath('./' . $board_config['avatar_path'] . '/' . $userdata['user_avatar'])); } An attacker can exploit this vulnerability by modifying the "avatarselect" return value from the gallery to point to the desired file to delete. The choice must be submitted twice for the attack to be successful. III. ANALYSIS Exploitation of this vulnerability allows remote attackers to unlink arbitrary system files under the privileges of the underlying web server. An attacker must have or be able to create an account on the target system. Non-default settings must be enabled for exploitation to be possible. An attacker can potentially further compromise the target system by erasing sensitive files such as .htaccess files that provide access control rules. IV. DETECTION iDEFENSE has confirmed the existence of this vulnerability in phpBB2 version 2.0.11. It is suspected that earlier versions are affected as well. "Enable gallery avatars" must be enabled for the target to be vulnerable. V. WORKAROUND Disable gallery avatars. This can be done through th phpBB administrative interface under "General Admin -> Configuration -> Avatar Settings". VI. VENDOR RESPONSE This vulnerability is addressed in phpBB version 2.0.12 available for download at: http://www.phpbb.com/downloads.php VII. CVE INFORMATION The Common Vulnerabilities and Exposures (CVE) project has assigned the names CAN-2005-0258 to these issues. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. VIII. DISCLOSURE TIMELINE 02/09/2005 Initial vendor notification 02/11/2005 Initial vendor response 02/22/2005 Public disclosure IX. CREDIT AnthraX101 (AnthraX101[at]gmail.com) is credited with this discovery. Get paid for vulnerability research http://www.idefense.com/poi/teams/vcp.jsp Free tools, research and upcoming events http://labs.idefense.com X. LEGAL NOTICES Copyright (c) 2005 iDEFENSE, Inc. Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDEFENSE. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email customerservice@idefense.com for permission. Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.