ID: 00160
Ref: 143/2005
Date: 23 February 2005:14:29:06
Version: 1
Title: Two iDEFENSE Security Advisories: 1. phpBB Group phpBB Arbitrary File Disclosure Vulnerability 2. phpBB Group phpBB2 Arbitrary File Unlink Vulnerability
Abstract:
Vendors affected: iDEFENSE
Operating systems affected: iDEFENSE
Applications affected: iDEFENSE
Title
=====
Two iDEFENSE Security Advisories:
1. phpBB Group phpBB Arbitrary File Disclosure Vulnerability
2. phpBB Group phpBB2 Arbitrary File Unlink Vulnerability
Detail
======
1. Remote exploitation of an input validation vulnerability in the phpBB
Group's phpBB2 bulletin board system allows attackers to read the
contents of arbitrary system files under the privileges of the web server.
phpBB is an open-source web-based bulletin board system written in PHP.
The problem specifically exists due to an input validation error that
allows a remote attacker to control the arguments in a call to copy().
2. Remote exploitation of an input validation vulnerability in the phpBB
Group's phpBB2 bulletin board system allows attackers to unlink (delete)
arbitrary system files under the privileges of the web server.
1.
phpBB Group phpBB Arbitrary File Disclosure Vulnerability
iDEFENSE Security Advisory 02.22.05
www.idefense.com/application/poi/display?id=204&type=vulnerabilities
February 22, 2005
I. BACKGROUND
phpBB is an open source bulletin board package written in the PHP web
scripting language. More information about phpBB is available from:
http://www.phpbb.com/
II. DESCRIPTION
Remote exploitation of an input validation vulnerability in the phpBB
Group's phpBB2 bulletin board system allows attackers to read the
contents of arbitrary system files under the privileges of the web server.
phpBB is an open-source web-based bulletin board system written in PHP.
The problem specifically exists due to an input validation error that
allows a remote attacker to control the arguments in a call to copy().
When a user requests to upload an avatar, the variable '$user_avatar_upload'
defaults to uploading from a remote URL and the variable '$avatar_mode'
defaults to uploading from the local computer. The variable '$user_avatar_upload'
contains either the remote URL or the temporary server name depending on
whether the source of the avatar to upload is local or remote. In the event
that both a local and remote upload are requested simultaneously, the
temporary upload location is substituted with the remote server name.
This will later be copied to the new location. By submitting a local
path rather then a URL, an attacker is able to execute an arbitrary
copy() command.
An attacker can exploit this input validation condition by selecting
an avatar from the local machine that meets the board guidelines and
can then fill the "Upload Avatar from a URL:" field with the path to
an arbitrary file (ex: /etc/passwd). When the avatar is submitted, the
destination image of the submitted avatar will contain the contents
of the requested file.
III. ANALYSIS
Exploitation of this vulnerability allows remote attackers to view
arbitrary system files under the privileges of the underlying web
server. An attacker must have, or be able to create an account on
the target system. Non-default settings must also be enabled for
exploitation to be possible. Upon successful exploitation an
attacker may be able to further compromise the system by gleaning
system information that would otherwise be inaccessible to the attacker.
IV. DETECTION
iDEFENSE has confirmed the existence of this vulnerability in phpBB2
version 2.0.11. It is suspected that earlier versions are affected
as well. "Enable remote avatars" and "Enable avatar uploading" must
be enabled for the target to be vulnerable.
V. WORKAROUND
Disable remote avatars and remove avatar uploading. This can be done
through th phpBB administrative interface under "General Admin ->
Configuration -> Avatar Settings". Alternatively, enable the 'open_basedir'
PHP security directive to lock file I/O operations to a specific directory.
VI. VENDOR RESPONSE
This vulnerability is addressed in phpBB version 2.0.12 available for
download at:
http://www.phpbb.com/downloads.php
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the
names CAN-2005-0259 to these issues. This is a candidate for inclusion
in the CVE list (http://cve.mitre.org), which standardizes names for
security problems.
VIII. DISCLOSURE TIMELINE
02/09/2005 Initial vendor notification
02/11/2005 Initial vendor response
02/22/2005 Public disclosure
IX. CREDIT
AnthraX101 (AnthraX101[at]gmail.com) is credited with this discovery.
Get paid for vulnerability research http://www.idefense.com/poi/teams/vcp.jsp
Free tools, research and upcoming events http://labs.idefense.com
X. LEGAL NOTICES
Copyright (c) 2005 iDEFENSE, Inc.
Permission is granted for the redistribution of this alert electronically.
It may not be edited in any way without the express written consent of iDEFENSE.
If you wish to reprint the whole or any part of this alert in any other medium
other than electronically, please email customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate at the
time of publishing based on currently available information. Use of the
information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the author
nor the publisher accepts any liability for any direct, indirect, or consequential
loss or damage arising from use of, or reliance on, this information.
2.
phpBB Group phpBB2 Arbitrary File Unlink Vulnerability
iDEFENSE Security Advisory 02.22.05
www.idefense.com/application/poi/display?id=205&type=vulnerabilities
February 22, 2005
I. BACKGROUND
phpBB is an open source bulletin board package written in the PHP
web scripting language. More information about phpBB is available from:
http://www.phpbb.com/
II. DESCRIPTION
Remote exploitation of an input validation vulnerability in the phpBB
Group's phpBB2 bulletin board system allows attackers to unlink (delete)
arbitrary system files under the privileges of the web server.
phpBB is an open-source web-based bulletin board system written in PHP.
The vulnerability specifically exists due to a combination of several
flaws that allows a remote attacker to control the arguments in a call
to unlink().The first flaw occurs in the avatar gallery, where a user is
permitted to specify part of the directory name for the desired avatar.
Directory traversal modifies (ex: "/../") are not properly filtered out,
allowing a user to break out of the default avatar directory. This issue
is realized in lines 68-71 of usercp_avatar.php:
if ( file_exists(@phpbb_realpath($board_config['avatar_gallery_path']
. '/' . $avatar_filename)) && ($mode == 'editprofile') )
{
$return = ", user_avatar = '" . str_replace("/'", "''",
$avatar_filename) . "', user_avatar_type = " .
USER_AVATAR_GALLERY;
}
Avatar's are then composed with the following code excerpt found in line
90 of usercp_viewprofile.php:
$avatar_img = ( $board_config['allow_avatar_local'] ) ? '
' : '';
The abused calls to unlink() are made when an avatar is deleted. There
is a guard around these functions requiring that the target avatar to
unlink exist in the avatar_path. This routine is also vulnerable to a
directory traversal attack. By issuing a large number of "/../" directory
traversal modifiers, an attacker is able to delete arbitrary system files.
The vulnerable segment of code shown here is from lines 473-478 of usercp_register.php:
if ( @file_exists(@phpbb_realpath('./' . $board_config['avatar_path']
. '/' . $userdata['user_avatar'])) )
{
@unlink(@phpbb_realpath('./' . $board_config['avatar_path'] . '/'
. $userdata['user_avatar']));
}
An attacker can exploit this vulnerability by modifying the "avatarselect"
return value from the gallery to point to the desired file to delete. The
choice must be submitted twice for the attack to be successful.
III. ANALYSIS
Exploitation of this vulnerability allows remote attackers to unlink arbitrary
system files under the privileges of the underlying web server. An attacker must
have or be able to create an account on the target system. Non-default settings
must be enabled for exploitation to be possible. An attacker can potentially
further compromise the target system by erasing sensitive files such as .htaccess
files that provide access control rules.
IV. DETECTION
iDEFENSE has confirmed the existence of this vulnerability in phpBB2 version 2.0.11.
It is suspected that earlier versions are affected as well. "Enable gallery avatars"
must be enabled for the target to be vulnerable.
V. WORKAROUND
Disable gallery avatars. This can be done through th phpBB administrative interface
under "General Admin -> Configuration -> Avatar Settings".
VI. VENDOR RESPONSE
This vulnerability is addressed in phpBB version 2.0.12 available for download at:
http://www.phpbb.com/downloads.php
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the names
CAN-2005-0258 to these issues. This is a candidate for inclusion in the CVE list
(http://cve.mitre.org), which standardizes names for security problems.
VIII. DISCLOSURE TIMELINE
02/09/2005 Initial vendor notification
02/11/2005 Initial vendor response
02/22/2005 Public disclosure
IX. CREDIT
AnthraX101 (AnthraX101[at]gmail.com) is credited with this discovery.
Get paid for vulnerability research http://www.idefense.com/poi/teams/vcp.jsp
Free tools, research and upcoming events http://labs.idefense.com
X. LEGAL NOTICES
Copyright (c) 2005 iDEFENSE, Inc.
Permission is granted for the redistribution of this alert electronically.
It may not be edited in any way without the express written consent of iDEFENSE.
If you wish to reprint the whole or any part of this alert in any other medium
other than electronically, please email customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate at the
time of publishing based on currently available information. Use of the
information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the author
nor the publisher accepts any liability for any direct, indirect, or
consequential loss or damage arising from use of, or reliance on,
this information.