exploit the possibilities

Collabtive 0.7.5 Shell Upload

Collabtive 0.7.5 Shell Upload
Posted Jun 6, 2012
Authored by Mark Hoopes

Collabtive versions 0.7.5 and below suffer from a remote shell upload vulnerability due to a failed MIME check that trusts a user supplied value.

tags | advisory, remote, shell
MD5 | 922d0853a88424f0436ede4ca5713343

Collabtive 0.7.5 Shell Upload

Change Mirror Download
TITLE: Arbitrary File Upload/Execution in Collabtive
DATE: 06-04-2012
PRODUCT: Collabtive Web-Based Project Management Software
VERSIONS: 0.7.5, 0.6.1 confirmed. All versions <= 0.7.5 probable
RESEARCHER: Mark Hoopes (xync@xync.org/)

During the upload of an avatar image for a Collabtive user, the
manageuser.php script checks the file type using the MIME type provided
in the POST request (via the $_FILES['userfile']['type'] variable)
rather than by extension. This MIME type can be spoofed via an
intercepting proxy or custom POST script allowing a malicious user to
upload an arbitrary file. This file will be placed in a predictable web
accessible path with an easily determined name. In most installations,
execution from this directory is not restricted which allows a remote
attacker to execute a PHP script uploaded this way with the privileges
of the web user.

Access to the avatar upload function is restricted to logged in users,
but because of Collabtive's design decisions in implementing OpenID
support, this is easily accomplished. If an unknown user supplies a
valid OpenID v1.0 URL as the username on the login page, Collabtive will
automatically create a new user based on the referenced credentials.
That new user is not authorized to access any projects, but is
authorized to upload an avatar image. This allows an attacker with no
other knowledge of the host site or its users to exploit the vulnerability.

Upgrade to Collabtive v0.7.6 or greater

Disable script execution of the upload directory via .htaccess for
Apache or similar web servers. This should apply at minimum to the
/files/[template]/avatar directory but can safely be applied to the
entire /files directory.

Sample contents of the .htaccess file are:
Options -Indexes
Options -ExecCGI
AddHandler cgi-script .php .php3 .php4 .phtml .pl .py .jsp .asp .htm
.shtml .sh .cgi

Note 'AllowOverride Options AddHandler' or 'AllowOverride All' must be
enabled in the main httpd.conf file for this directory or inherited from
a parent directory.
See http://www.mysql-apache-php.com/fileupload-security.htm

Additional References:

http://www.php.net/manual/en/features.file-upload.post-method.php see
comments for $_FILES['userfile']['type']

April 18, 2012 - Issue reported to developers
April 19, 2012 - Fix committed to Collabtive github
May 30, 2012 - Collabtive version 0.7.6 released w/ fix
June 4, 2012 - Vulnerability published


RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

May 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    16 Files
  • 2
    May 2nd
    8 Files
  • 3
    May 3rd
    8 Files
  • 4
    May 4th
    2 Files
  • 5
    May 5th
    1 Files
  • 6
    May 6th
    15 Files
  • 7
    May 7th
    22 Files
  • 8
    May 8th
    16 Files
  • 9
    May 9th
    17 Files
  • 10
    May 10th
    16 Files
  • 11
    May 11th
    3 Files
  • 12
    May 12th
    4 Files
  • 13
    May 13th
    25 Files
  • 14
    May 14th
    24 Files
  • 15
    May 15th
    78 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    16 Files
  • 18
    May 18th
    2 Files
  • 19
    May 19th
    1 Files
  • 20
    May 20th
    11 Files
  • 21
    May 21st
    21 Files
  • 22
    May 22nd
    20 Files
  • 23
    May 23rd
    36 Files
  • 24
    May 24th
    2 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2019 Packet Storm. All rights reserved.

Security Services
Hosting By