Mambo Open Source, Path disclosure

[alireza hassani]

[KAPDA::#11] - Mambo Open Source, Path disclosure
KAPDA New advisory
Vendor: http://www.mamboserver.com
Vulnerable Versions: 4.5.2.3 , 4.5.2.2 , 4.5.2.1
,4.5.2
Bug: path disclosure
Exploitation: Remote with browser
Discussion:
--------------------
Mambo is a feature-rich dynamic portal engine/content
management tool capable of building sites from several
pages to several thousand. Mambo uses PHP/MySQL and
features a very comprehensive admin manager.

Vulnerability:
--------------------
A remote user can supply a specially crafted URL to
cause the system to display an error message that
discloses the installation path and other data.
Bug exists in "content.php" (Content Component of
mambo)
Demonstration URL :
--------------------
http://www.example.com/mambo/index.p...=1&Itemid=PATH
Solution:
--------------------
There is no vendor-supplied patch for this issue at
this time but we are not advising you to upgrade to
Joomla because Mambo, version 4.5.3, will be released
soon ( by the end of November this year).
4.5.3 represents the new Team’s first consolidation
of bug fixes and includes a number of security
enhancements.

More Detail:
--------------------
Original advisory:
http://irannetjob.com/content/view/153/28/
Farsi distribution of mambo: http://www.mambo.ir

Credit :
--------------------
Discovered & released by trueend5 (trueend5 kapda ir)
Security Science Researchers Institute Of Iran
[http://www.KAPDA.ir]




__________________________________
Yahoo! FareChase: Search multiple travel sites in one click.
http://farechase.yahoo.com

[Vasiliy]

alireza hassani wrote:
> Demonstration URL :

> --------------------
> http://www.example.com/mambo/index.p...=1&Itemid=PATH

I've just tried this on one of my "vulnerable" Mambo installations
and got nothing, but the blank screen. I wonder why this happened?..
Could it be because of displaying php errors turned off as it should be
done in any production environment?


> Solution:
> --------------------
> There is no vendor-supplied patch for this issue at
> this time but we are not advising you to upgrade to
> Joomla because Mambo, version 4.5.3, will be released
> soon ( by the end of November this year).
> 4.5.3 represents the new Team’s first consolidation
> of bug fixes and includes a number of security
> enhancements.

Isn't this "solution" somewhat overcomplicated? If someone wants to
workaround this bug, it's not necessary to upgrade. It would be enough
just to follow basic security principles.

--
wbr,
Vasiliy

[trueend5@yahoo.com]

You are right
mamboserver soloution is available now:
The fix is easy,

in /component/com_content/content.php
Approx Line 190 Change the block FROM:


Code:
// Paramters
$params = new stdClass();
if ( $Itemid ) {
$menu = new mosMenu( $database );
$menu->load( $Itemid );
$params =& new mosParameters( $menu->params );
} else {
$menu = "";
$params =& new mosEmpty();

}

CHANGE TO READ:

Code:
// Paramters
$params = new stdClass();
if ( $Itemid ) {
$menu = new mosMenu( $database );
$menu->load( $Itemid );
$params =& new mosParameters( $menu->params );
} else {
$menu = "";
$params =& new mosParameters(''); //mosEmpty();

}
best regards
Alireza Hassani
Security Science Researchers Institute Of Iran
[http://www.KAPDA.ir]