Exploit the possiblities

HumHub 0.10.0 File Upload / Remote Code Execution

HumHub 0.10.0 File Upload / Remote Code Execution
Posted Feb 14, 2015
Authored by Jos Wetzels

HumHub versions 0.10.0 and below suffer from .htaccess file upload and remote code execution vulnerabilities.

tags | advisory, remote, vulnerability, code execution, file upload
MD5 | 1a2f977b23698123131aa68144a0a8b2

HumHub 0.10.0 File Upload / Remote Code Execution

Change Mirror Download
[+] HumHub .htaccess file upload vulnerability and remote code execution
[+] Discovered by: Jos Wetzels
[+] Vendor: HumHub
[+] Product: HumHub
[+] Versions affected: 0.10.0 and earlier.
[+] Advisory URL: https://www.leakfree.nl/advisories/leakfree_2015_003.html

HumHub [1] versions 0.10.0 and prior suffer from a file upload
sanitation vulnerability which allows an attacker to upload arbitrary
.htaccess files with varying consequences [2]. On default
installations this allows an attacker to achieve remote code execution
while on a minority of installations it allows an attacker to execute
an XSS or CSRF attack.

Direct access to the uploads/file/ directory is denied by HumHub
through the usage of .htaccess but an attacker can upload a .htaccess
file starting with:

<Files ~ "^\.ht">
# Uncomment line below for Apache >= 2.4
# Require all granted
Order allow,deny
Allow from all
</Files>

To allow direct access to the uploaded .htaccess file (and override
general .htaccess settings within the directory). Depending on the
enabled apache modules an attacker can execute various types of
attacks ranging from information disclosure (when mod_info and
mod_status are enabled), eg.:

SetHandler server-info

to remote code execution, eg.:

AddType application/x-httpd-php .htaccess
# <?php phpinfo(); ?>

HumHub comes with a .htaccess.dist [3] file in the HumHub root
directory which, if enabled by the user, prevents direct access to
dotfiles (such as .htaccess, .svn, .git, etc.) using mod_rewrite.
Since mod_rewrite is unaffected by the override (and using the
RewriteEngine Off directive does not affect the .htaccess file itself)
this prevents the above scenario from being exploitable. Regardless,
it is still possible for an attacker to execute an unrestricted XSS or
CSRF attack by abusing the ErrorDocument directive, eg.:

ErrorDocument 403 <htmlpayload>

Since the included .htaccess.dist is not enabled by default, however,
an attacker can exploit this vulnerability to its full extent on an
out-of-the-box HumHub installation.

[*] References:

1. http://humhub.org
2. https://github.com/wireghoul/htshells
3. https://github.com/humhub/humhub/blob/master/.htaccess.dist


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

February 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    15 Files
  • 2
    Feb 2nd
    15 Files
  • 3
    Feb 3rd
    15 Files
  • 4
    Feb 4th
    13 Files
  • 5
    Feb 5th
    16 Files
  • 6
    Feb 6th
    15 Files
  • 7
    Feb 7th
    15 Files
  • 8
    Feb 8th
    15 Files
  • 9
    Feb 9th
    18 Files
  • 10
    Feb 10th
    8 Files
  • 11
    Feb 11th
    8 Files
  • 12
    Feb 12th
    17 Files
  • 13
    Feb 13th
    15 Files
  • 14
    Feb 14th
    15 Files
  • 15
    Feb 15th
    17 Files
  • 16
    Feb 16th
    18 Files
  • 17
    Feb 17th
    37 Files
  • 18
    Feb 18th
    2 Files
  • 19
    Feb 19th
    16 Files
  • 20
    Feb 20th
    6 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close