> Vulnerabilities in EGroupware 1.8.005
> Discovered by Pedro Ribeiro (pedrib@gmail.com) of Agile Information Security

====================================================================
Vulnerability: PHP object insertion leading to all kinds of badness (arbitrary file deletion, possible code execution) (CVE-2014-2027)
File(line): egroupware/addressbook/csv_import.php(257,258)
File(line): egroupware/calendar/csv_import.php(277,278)
File(line): egroupware/projectmanager/csv_import.php(324,325)
File(line): egroupware/infolog/csv_import.php(336,337)
File(line): egroupware/preferences/inc/class.uiaclprefs.inc.php(108)
Code snippet:

egroupware/addressbook/csv_import.php(257,258):
case 'next':
  $_POST['addr_fields'] = unserialize(stripslashes($_POST['addr_fields']));
  $_POST['trans']       = unserialize(stripslashes($_POST['trans']));


egroupware/calendar/csv_import.php(277,278):
case 'next':
  $_POST['cal_fields'] = unserialize(stripslashes($_POST['cal_fields']));
  $_POST['trans']       = unserialize(stripslashes($_POST['trans']));


egroupware/projectmanager/csv_import.php(324,325):
egroupware/infolog/csv_import.php(336,337):
case 'next':
  $_POST['info_fields'] = unserialize(stripslashes($_POST['info_fields']));
  $_POST['trans']       = unserialize(stripslashes($_POST['trans']));


egroupware/preferences/inc/class.uiaclprefs.inc.php(108):
if ($_POST['save'] || $_POST['apply'])
{
  $processed = $_POST['processed'];
  $to_remove = unserialize(urldecode($processed));


Arbitrary file overwrite in __destruct:
egroupware/etemplate/inc/class.etemplate_request_files.inc.php
140          function __destruct()
141          {
142                  if ($this->remove_if_not_modified && !$this->data_modified)
143                  {
144                          //error_log(__METHOD__."() destroying $this->id");
145                          @unlink(self::$directory.'/'.$this->id);
146                  }
147                  elseif (!$this->destroyed && $this->data_modified &&
148                          !file_put_contents($filename = self::$directory.'/'.$this->id,serialize($this->data)))
149                  {
150                          error_log("Error opening '$filename' to store the etemplate request data!");
151                  }
152          }

  
Comment:
User input is passed directly into unserialize(), leading to object insertion, arbitrary file deletion and possible code execution.
There are lots of classes with exploitable magic methods, and the above is just an example.

  
References:
https://www.owasp.org/index.php/PHP_Object_Injection
http://www.alertlogic.com/writing-exploits-for-exotic-bug-classes/
http://www.suspekt.org/downloads/POC2009-ShockingNewsInPHPExploitation.pdf
http://vagosec.org/2013/12/wordpress-rce-exploit/