[ECHO_ADV_20$2005] Full path disclosure JAF CMS

[the_day@echo.or.id]

---------------------------------------------------------------------------
[ECHO_ADV_20$2005] Full path disclosure JAF CMS
---------------------------------------------------------------------------

Author: Dedi Dwianto
Date: June, 23th 2005
Location: Indonesia, Jakarta
Web: http://echo.or.id/adv/adv20-theday-2005.txt

---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : JAF CMS
version: < 3.0 Final
URL : http://jaf-cms.opensource-indonesia.com
Author : Salim "ph03y3nk"
Description :

JAF CMS - ...just another flat file CMS, is a Content Management System (CMS)
consist of a powerful set of PHP scripts that allow you to maintain personal
home page. There is no need for a database. The pages stored in a simple flat
file. I've coded this script because I realize that its hard to found server
(especially free space) offering PHP with database support already.

---------------------------------------------------------------------------

Vulnerabilities:
~~~~~~~~~~~~~~~~

A. Full path disclosure:

A remote user can access the file directly to cause the system to display
an error message that indicates the installation path. The resulting error
message will disclose potentially sensitive installation path information
to the remote attacker.

* http://victim/index.php?page=forum&category=general&id=[id]/*

POC :

http://localhost/jaf-cms/index.php?page=forum&category=general&id=3/*

Warning: fopen(module/files/3/*): failed to open stream: No such file or directory
in /var/www/html/jaf-cms/module/forum/inc/csvfile.php on line 197


* http://victim/index.php?page=forum&view_type=topic&id=/*

POC :

http://localhost/jaf-cms/index.php?page=forum&view_type=topic&id=

Warning: fopen(module/files/): failed to open stream: Is a directory
in /var/www/html/jaf-cms/module/forum/inc/csvfile.php on line 197


* http://victim/index.php?page=guestbook&disp=[id]/*

POC :

http://victim/index.php?page=guestbook&disp=[id]/*

Notice: Undefined offset: 6 in /var/www/html/jaf-cm/module/guestbook/guestbook.php on line 250


B. Fix
report to vendor 21 June 2005
vendor No response

For User and do not know how to fix the script , change php.ini file setting
then turn on log_errors , and turn off display_error

---------------------------------------------------------------------------

Shoutz:
~~~~~~~

~ y3dips, moby, comex, z3r0byt3, K-159, c-a-s-e, S`to, lirva32, anonymous
~ Lieur Euy , MSR
~ newbie_hacker@yahoogroups.com ,
~ #e-c-h-o@DALNET

---------------------------------------------------------------------------
Contact:
~~~~~~~~

the_day || echo|staff || the_day[at]echo[dot]or[dot]id
Homepage: http://theday.echo.or.id/

-------------------------------- [ EOF ] ----------------------------------

[Steven M. Christey]

Two of these "full path disclosure" error messages suggest a much more
serious problem:

http://localhost/jaf-cms/index.php?page=forum&category=general&id=3/*

Warning: fopen(module/files/3/*): failed to open stream: No such
file or directory in
/var/www/html/jaf-cms/module/forum/inc/csvfile.php on line 197

The attacker's input - the "id" parameter - is eventually being used
in an fopen call.

Is the input being filtered or cleansed anywhere? Is this really a
directory traversal problem? Can the attacker open arbitrary files?

I don't have the tool installed, so I can't verify, but here are some
clues from the source code.

In forum.php in 3.0 Final:

/* note: no previous mention of $id anywhere until the next line */

if(isset($id))
{ /* main data base access */
$base_comment_file = new csvfile;
$base_comment_file->name="module/files/".$id;


In csvfile.php, the cvsfile class is defined with the following
method:

function open( $mode )
// opens the data source
{
if ( ! $this->handle = fopen( $this->name, $mode ) )
{
return false;
}

So maybe at least CSV formatted files can be read; maybe arbitrary
files can be modified if any are opened in write mode?

Again, I don't have the tool involved, so I can't prove it for sure.

- Steve