Bugtraqmailing list archives
STG Security Advisory: [SSA-20041224-21] File extensions restriction bypass vulnerability in GNUBoard
From: <advisory () stgsecurity com>
Date: 3 Jan 2005 07:42:02 -0000
STG Security Advisory: [SSA-20041224-21] File extensions restriction bypassvulnerability in GNUBoard.Revision 1.0Date Published: 2004-12-24 (KST)Last Update: 2005-01-03Disclosed by SSR Team (advisory () stgsecurity com)Summary========GNUBoard is one of widely used web BBS applications in Korea. However, aninput validation flaw can cause malicious attackers to run arbitrarycommands with the privilege of the HTTPD process, which is typically run asthe nobody user.Vulnerability Class===================Implementation Error: Input validation flawImpact======High : arbitrary command execution.Affected Products================GNUBoard 3.40 and priorVendor Status: NOT FIXED========================2004-12-09 Vulnerability found2004-12-09 Vendor contacted and confirmed.2005-01-03 Official release.Details=======Implementation of check every file extension of upload files iscase-sensitive. Bypassing this mechanism, malicious attackers can uploadarbitrary script files (php, pl, cgi, etc) to a web server.gbupdate.php (107 line)- ----// 실행가능한 스크립트 확장자$source = array ("/\.php/", "/\.htm/", "/\.cgi/", "/\.pl/");$target = array (".phpx", ".htmx", ".cgix", ".plx");- ----gbupdate.php (142 line)- ---- // php_x 와 같은 방법으로 스크립트 실행을 하지 못하게 하였으나 abc.php._x는 실행되는 버그가 있음 $filename = preg_replace($source, $target, $filename); // 접두사를 붙인 파일명 $upload[$i] = $prefix . $filename; $dest_file = "./data/file/$bo_table/$upload[$i]";- ----malicious attackers can upload [attack].PHP.rar, [attack].pHp.rar, etc.Solution=========modify 108th line of gbupdate.php as following$source = array ("/\.php/i", "/\.htm/i", "/\.cgi/i", "/\.pl/i");Vendor URL==========http://www.sir.co.kr/Credits======Jeremy Bae at STG SecurityCurrent thread:
- STG Security Advisory: [SSA-20041224-21] File extensions restriction bypass vulnerability in GNUBoardadvisory (Jan 03)