[//-------------------------------------------------------------------]
[ CastleCops(SM) Security Advisory 14 Dec 2004 ]
[---------------------------------------------------------------------]
[ http://castlecops.com/ ]
[---------------------------------------------------------------------]
Severity: High
Title: phpBB Attachment Mod Directory Traversal HTTP POST Injection
Date: 7 December 2004
ID: http://castlecops.com/postp393483.html
[---------------------------------------------------------------------]
Summary
-------
phpBB is "a high powered, fully scalable, and highly customizable
open-source bulletin board package. phpBB has a user-friendly
interface, simple and straightforward administration panel, and
helpful FAQ. Based on the powerful PHP server language and your
choice of MySQL, MS-SQL, PostgreSQL or Access/ODBC database servers,
phpBB is the ideal free community solution for all web sites."
An HTTP POST Injection exists in the Attachment Mod written by Meik
Sievertsen AKA Acyd Burn (acyd.burn@gmx.de / http://opentools.de)
that enables anyone to traverse directories on the web server.
Affected Packages
-----------------
- Attachment module 2.3.10 and earlier
Immune Packages
---------------
- Attachment module 2.3.11
Description
-----------
Due to the lack of properly sanitizing the filename in the
attachment mod user interface, a user may inject a filename via
HTTP POST that includes directory traversal: "../../". This filename
injection is inserted (or updated) into the attachmod table
($prefix_attachments_desc) in the "physical_filename" and/or
"real_filename" fields. The attach_mod/posting_attachments.php file
requires filename sanitization to prevent the directory traversal
portion from being saved in the table.
Once the database table has a directory traversal filename stored
such as "../../$newfilename", using the download.php file to obtain
the download will traverse outside the UPLOAD_DIR location and send
the "../../$newfilename" to the user (where $newfilename is the name
of an actual file on the filesystem). This has been tested in the
website's webroot only, and not outside of it. However, in theory,
a server could serve up files in /etc or elsewhere via this method.
In addition, theory suggests that
attach_mod/includes/functions_attach.php's unlink_attach function
may not properly sanitize the $filename when a user tries to delete
a file. It is suggested the author inspect this and patch as
required.
Impact
------
With this an attacker could be able to add/remove/execute files
outside of the UPLOAD_DIR directory.
Proof Of Concept
----------------
1) Visit a website that has attachmod installed in phpBB.
2) Start a new topic, attach a file via the "Add Attachment" input
button.
3) Prior to clicking "Submit", view the page source via your
browser's "View Source".
4) Modify the