|
|
Application: Bytehoard
Versions: 2.1 (alpha to epsilon)
Release Date: 2007-11-26
Author: Ernesto Alvarez / Activesec SA
Kudos to: Rodrigo Seguel / Activesec SA for suggesting the session
destruction approach
Contact info: ealvarez at activesec biz
Developer response: None. No response to mail, forum inactive and
bugtracker operating intermitently.
Privilege escalation in bytehoard 2.1
Background
Bytehoard is a web application written in PHP that serves as a file
storage and sharing system.
It has two levels of security, a user level and an admin level. Login is
required but it can be configured to allow anyone to obtain a user level
account if desired.
Summary
It is possible for a non admin user to gain admin privileges on
bytehoard 2.1, by overwriting a session variable if the php option
"register_globals" is enabled. This variable can be overwritten by
abusing the "register user" or the "password reset" module.
Impact
A non-admin user can gain admin privileges, access another accounts and
do operations under nonexistent accounts.
Preconditions
PHP setting "register_globals" must be enabled.
Exploit (1)
Log into bytehoard using a non privileged user.
Perform any desired actions, then log out.
Click on the "Lost Details" link.
Input the desired username you want to have access to ("admin" to get
administrator access) and submit the data.
The system will either return an error message or a "mail sent" message.
Ignore the last message and go directly to the index.php page (easily
obtained by erasing the "?page=passreset" part)
You should have access to the desired account.
Exploit (2)
Log into bytehoard using a non privileged user.
Perform any desired actions, then log out.
Click on the "Sign Up" link.
Input the desired username you want to have access to (ignore the other
parameters) and submit the data.
The system will either return an error message (or a success message if
you complete everything).
Ignore the last message and go directly to the index.php page (easily
obtained by erasing the "?page=signup" part)
You should have access to the desired account.
Details
This privilege escalation is a direct consequence of using the same name
on a local variable ("username" on "modules/passreset.inc.php" and
"modules/signup.inc.php") and a global variable
("$_SESSION['username']"). When the "register_globals" setting is
enabled and the session variable "username" is set (to any value,
including empty string), any changes made to the local variables will
also be written on the global one.
Since both modules set the variable to a user input string, and the
authentication module uses that global variable to both determine if the
user is logged in and which username to use, following the instructions
given in the exploit section give immediate access.
This bug does not manifest itself if nobody successfully logins first
within the session where the exploit is attempted since the session
variable "username" would not be set, and therefore would not be
overwritten by the php interpreter.
Recommended actions
Change the variable name "username" first referenced in line 22 of
"modules/passreset.inc.php" to something else.
Change the variable name "username" first referenced in line 24 of
"modules/signup.inc.php" to something else.
Ensure proper session destruction during logout.
Disable the "register_globals" setting for bytehoard.
Notes
Depending on the situation, this can be seen as more than a privilege
escalation, since a malicious attacker can trick a legitimate user into
logging using an attacker controlled computer or using session fixation.
Were a method of setting the "$_SESSION['username']" found without
having to log in, this exploit would become a remote root (for the
application, not the host).
These methods can also be used to escalate privileges to a nonexistent
account. In that case, a home directory is created for that "phantom"
user, and the system behaves normally, but no account is created. The
phantom user's data can be retrieved by repeating the exploit.
===========================================================================================================================
Application: Bytehoard
Versions: 2.1 (alpha to epsilon)
Release Date: 2007-11-26
Author: Ernesto Alvarez / Activesec SA
Contact info: ealvarez at activesec biz
Developer response: None. No response to mail, forum inactive and
bugtracker operating intermitently.
Directory traversal in bytehoard 2.1
Background
Bytehoard is a web application written in PHP that serves as a file
storage and sharing system.
It has two levels of security, a user level and an admin level. Login is
required but it can be configured to allow anyone to obtain a user level
account if desired.
Summary
It is possible for an admin user to upload a file to the filestorage's
parent directory. Under default conditions, this directory is
bytehoard's document root, and world writable.
Impact
None. It was thought to be an arbitrary execution risk, but as noted by
the Secunia Research team, an administrator can change the virtual root
and can upload files to any directory in the web server. This reference
is kept because it is a bug worth noticing and the patch included with
in this document patches both bugs.
Preconditions
The attacker must have access to a bytehoard administrative account.
(See previous privilege escalation to meet this precondition)
The web server must execute php (or similar) files in the filestorage's
parent directory
Exploit
Log in as a bytehoard administrator
Click the "Upload files" link
Change upload directory to an arbitrary path (by pushing the change
button and selecting another directory)
Edit the "infolder" GET parameter to ".." and go to the resulting url
The resulting page should read "Uploading to: .." to the left of the
change button
Select a php file with a shell, exploit or action to be run in one of
the upload slots, upload the file
There should be an error trying to stat the uploaded file but bytehoard
should continue the upload process
The file has been deposited in the filestorage's parent directory and
will be executed if called
Details
Before moving a file to its final location, its path name is sent
through the function "bh_fpclean()" in
"includes/filesystem/filesystem/filesystem.inc.php" in order to canonize
its name and filter possible traversal attacks. This filter removes all
"/.." substrings but fails to remove two dots without a preceding slash.
By entering ".." (or ".." followed by a path) as the directory name, the
filter takes no action. Bytehoard then uses this tainted path and places
the file in the filestorage's parent directory.
If bytehoard is installed in its default configuration, this directory
would be the document root, and the file deposited there would be read
or executed by the web server. Also according to the installation guide,
this directory should be made world readable, writable and executable,
allowing the webserver to deposit that file unimpeded.
For normal users this attack is stopped by the access control system,
because it determines that the user has not enough privileges to write
the file. Instant access is granted to administrators, though. See
function "bh_checkrights()" in
"includes/filesystem/filesystem/filesystem.inc.php".
Recommended actions
Modify the filter "bh_fpclean()" in
"includes/filesystem/filesystem/filesystem.inc.php" to prevent this type
of traversal attack
Make the bytehoard document root and its files not writable by the web
server. Apart from the filestorage, it is only necessary to make the
file "log" and the directory "cache" writable for bytehoard to be
usable. This still leaves the possibility that an attacker will try to
deposit a file on "log" or "cache".
Move the filestorage out of the path served by the webserver.
If the filestorage must remain in the path served by the webserver,
consider putting it under a second, read only directory.
Notes
This attack can be used to read (among other things) the credentials
stored in "config.inc.php", gaining access to the database used by
bytehoard.
========================================================================================================================
Patch
A stopgap patch was made that tries to neutralize these two bugs. The
patch included applies the first two recommended actions for the
escalation bug. It also destroys session data, but does not completely
destroy the session itself. It also modifies the filter to block the
second attack. However, it will also modify any legitimate file path
with two consecutive dots in it.
This patch can be applied to any installed bytehoard 2.1/epsilon. It
should be installed by running "patch -p1 < PATCH-NAME" in the document
root (where index.php lies).
-------------------------PATCH BEGINS
HERE--------------------------------------------------------------------------
diff -u -r bytehoard-2.1-epsilon/includes/auth/bytehoard.inc.php
bytehoard-2.1-zeta/includes/auth/bytehoard.inc.php
--- bytehoard-2.1-epsilon/includes/auth/bytehoard.inc.php 2005-10-20
13:38:24.000000000 -0300
+++ bytehoard-2.1-zeta/includes/auth/bytehoard.inc.php 2007-11-20
11:24:46.553418600 -0300
@@ -38,6 +38,7 @@
# Returns the bhsession array as above.
function bh_session_destroy() {
$_SESSION['username'] = "";
+ session_destroy();
return array("username"=>$_SESSION['username']);
}
@@ -62,4 +63,4 @@
$result = update_bhdb("users", array("password"=>md5($password)),
array("username"=>$username));
# The _bhdb functions return false for success.
return true;
-}
\ No newline at end of file
+}
diff -u -r bytehoard-2.1-epsilon/includes/auth/ldap.inc.php
bytehoard-2.1-zeta/includes/auth/ldap.inc.php
--- bytehoard-2.1-epsilon/includes/auth/ldap.inc.php 2006-02-22
16:11:14.000000000 -0300
+++ bytehoard-2.1-zeta/includes/auth/ldap.inc.php 2007-11-20
11:25:26.246384352 -0300
@@ -42,6 +42,7 @@
# Returns the bhsession array as above.
function bh_session_destroy() {
$_SESSION['username'] = "";
+ session_destroy();
return array("username"=>$_SESSION['username']);
}
@@ -99,4 +100,4 @@
function bh_auth_set_password($username, $password) {
# NOT SUPPORTED
return false;
-}
\ No newline at end of file
+}
diff -u -r bytehoard-2.1-epsilon/includes/auth/ldap_base.inc.php
bytehoard-2.1-zeta/includes/auth/ldap_base.inc.php
--- bytehoard-2.1-epsilon/includes/auth/ldap_base.inc.php 2006-02-22
16:11:42.000000000 -0300
+++ bytehoard-2.1-zeta/includes/auth/ldap_base.inc.php 2007-11-20
11:25:52.365413656 -0300
@@ -42,6 +42,7 @@
# Returns the bhsession array as above.
function bh_session_destroy() {
$_SESSION['username'] = "";
+ session_destroy();
return array("username"=>$_SESSION['username']);
}
@@ -108,4 +109,4 @@
function bh_auth_set_password($username, $password) {
# NOT SUPPORTED
return false;
-}
\ No newline at end of file
+}
diff -u -r bytehoard-2.1-epsilon/includes/auth/phpbb2.inc.php
bytehoard-2.1-zeta/includes/auth/phpbb2.inc.php
--- bytehoard-2.1-epsilon/includes/auth/phpbb2.inc.php 2005-10-20
13:38:24.000000000 -0300
+++ bytehoard-2.1-zeta/includes/auth/phpbb2.inc.php 2007-11-20
11:27:47.858855984 -0300
@@ -126,6 +126,8 @@
$dbconfig['prefix'] = $oldprefix;
$dbconfig['db'] = $olddb;
+ session_destroy();
+
return array("username"=>"");
}
@@ -149,4 +151,4 @@
if (empty($authrows)) { return 0; }
else { return 1; }
-}
\ No newline at end of file
+}
diff -u -r
bytehoard-2.1-epsilon/includes/filesystem/filesystem/filesystem.inc.php
bytehoard-2.1-zeta/includes/filesystem/filesystem/filesystem.inc.php
---
bytehoard-2.1-epsilon/includes/filesystem/filesystem/filesystem.inc.php
2007-11-20 13:00:07.152755312 -0300
+++
bytehoard-2.1-zeta/includes/filesystem/filesystem/filesystem.inc.php
2007-11-20 12:09:13.751942792 -0300
@@ -570,8 +570,8 @@
# This function cleans any string passed to it so it's a valid
filepath - in case something sends a bad one.
function bh_fpclean($filepath) {
-
- $filepath = urldecode(str_replace("/..", "", $filepath)); # Get rid
of any nasty directory ups and URL encodes.
+
+ $filepath = urldecode(str_replace("..", "", $filepath)); # Get rid of
any nasty directory ups and URL encodes.
if (substr($filepath, -1) == "/") {
$filepath = substr($filepath, 0, -1); # Get rid of any trailing
slashes.
@@ -585,7 +585,7 @@
$filepath = str_replace($badcharacters, "", $filepath); # Get rid of
any bad characters
$filepath = str_replace("//", "/", $filepath); # Get rid of any
double slashes
-
+
return $filepath;
}
diff -u -r bytehoard-2.1-epsilon/modules/passreset.inc.php
bytehoard-2.1-zeta/modules/passreset.inc.php
--- bytehoard-2.1-epsilon/modules/passreset.inc.php 2005-10-20
13:38:12.000000000 -0300
+++ bytehoard-2.1-zeta/modules/passreset.inc.php 2007-11-20
11:13:39.990751528 -0300
@@ -19,8 +19,8 @@
# See if there is a reset request
if (!empty($_POST['reset_username'])) {
# See if the username exists
- $username = $_POST['reset_username'];
- $userrows = select_bhdb("users", array("username"=>$username), "");
+ $xgqd_username = $_POST['reset_username'];
+ $userrows = select_bhdb("users", array("username"=>$xgqd_username), "");
if (empty($userrows)) {
# Open layout object
$layoutobj = new bhlayout("generic");
@@ -31,16 +31,16 @@
} else {
# Insert a password reset request row for that username
$resetid = md5(time().rand(1, 99999).rand(54, time()));
- insert_bhdb("passwordresets", array("username"=>$username,
"resetid"=>$resetid, "time"=>time()));
+ insert_bhdb("passwordresets", array("username"=>$xgqd_username,
"resetid"=>$resetid, "time"=>time()));
# Get their email address
- $userirows = select_bhdb("userinfo", array("username"=>$username,
"itemname"=>"email"), "");
+ $userirows = select_bhdb("userinfo",
array("username"=>$xgqd_username, "itemname"=>"email"), "");
$emailaddr = $userirows[0]['itemcontent'];
# Email them about it with the validation link
$emailobj = new bhemail($emailaddr);
$emailobj->subject = str_replace("#SITENAME#",
$bhconfig['sitename'], $bhlang['emailsubject:passreset_request']);
- $emailobj->message = str_replace("#LINK#",
bh_get_weburi()."/index.php?page=passreset&doresetid=$resetid&username=$username",
$bhlang['email:passreset_request']);
+ $emailobj->message = str_replace("#LINK#",
bh_get_weburi()."/index.php?page=passreset&doresetid=$resetid&username=$xgqd_username",
$bhlang['email:passreset_request']);
$emailaway = $emailobj->send();
if ($emailaway == false) {
# Open layout object
@@ -73,9 +73,9 @@
$layoutobj->display();
} else {
# Insert a password reset request row for that username
- $username = $userirows[0]['username'];
+ $xgqd_username = $userirows[0]['username'];
$resetid = md5(time().rand(1, 99999).rand(54, time()));
- insert_bhdb("passwordresets", array("username"=>$username,
"resetid"=>$resetid, "time"=>time()));
+ insert_bhdb("passwordresets", array("username"=>$xgqd_username,
"resetid"=>$resetid, "time"=>time()));
# Get their email address
$emailaddr = $userirows[0]['itemcontent'];
@@ -83,7 +83,7 @@
# Email them about it with the validation link
$emailobj = new bhemail($emailaddr);
$emailobj->subject = str_replace("#SITENAME#",
$bhconfig['sitename'], $bhlang['emailsubject:passreset_u_request']);
- $emailobj->message = str_replace("#LINK#",
bh_get_weburi()."/index.php?page=passreset&doresetid=$resetid&username=$username",
str_replace("#USERNAME#", $username, $bhlang['email:passreset_u_request']));
+ $emailobj->message = str_replace("#LINK#",
bh_get_weburi()."/index.php?page=passreset&doresetid=$resetid&username=$xgqd_username",
str_replace("#USERNAME#", $xgqd_username,
$bhlang['email:passreset_u_request']));
$emailaway = $emailobj->send();
if ($emailaway == false) {
# Open layout object
@@ -180,4 +180,4 @@
}
-?>
\ No newline at end of file
+?>
diff -u -r bytehoard-2.1-epsilon/modules/signup.inc.php
bytehoard-2.1-zeta/modules/signup.inc.php
--- bytehoard-2.1-epsilon/modules/signup.inc.php 2005-10-20
13:38:12.000000000 -0300
+++ bytehoard-2.1-zeta/modules/signup.inc.php 2007-11-20
11:10:52.031285248 -0300
@@ -22,11 +22,11 @@
# Check username isn't reserved or in use. We test for admin,
administrator, guest, and all because they may all get used.
# Even though a few are in the users table anyway.
- $username = strtolower($signup['username']);
- $usernamerows = select_bhdb("users", array("username"=>$username), "");
- $regusernamerows = select_bhdb("registrations",
array("username"=>$username), "");
+ $vlhq_username = strtolower($signup['username']);
+ $usernamerows = select_bhdb("users",
array("username"=>$vlhq_username), "");
+ $regusernamerows = select_bhdb("registrations",
array("username"=>$vlhq_username), "");
- if ((!empty($usernamerows)) || (!empty($regusernamerows)) ||
($username == "guest") || ($username == "admin") || ($username ==
"administrator") || ($username == "all")) {
+ if ((!empty($usernamerows)) || (!empty($regusernamerows)) ||
($username == "guest") || ($vlhq_username == "admin") || ($vlhq_username
== "administrator") || ($vlhq_username == "all")) {
bh_log($bhlang['error:username_in_use'], BH_ERROR);
# Open layout object
$layoutobj = new bhlayout("signup");
@@ -36,7 +36,7 @@
$layoutobj->content1 = $_POST['signup'];
$layoutobj->display();
- } elseif (strlen($username) > 255) {
+ } elseif (strlen($vlhq_username) > 255) {
bh_log($bhlang['error:username_too_long'], BH_ERROR);
# Open layout object
$layoutobj = new bhlayout("signup");
@@ -90,7 +90,7 @@
# Dispatch an email
$emailobj = new bhemail($signup['email']);
$emailobj->subject = str_replace("#SITENAME#",
$bhconfig['sitename'], $bhlang['emailsubject:registration_validation']);
- $emailobj->message = str_replace("#LINK#",
bh_get_weburi()."/index.php?page=signup&confirmregid=$regid&username=$username",
$bhlang['email:registration_validation']);
+ $emailobj->message = str_replace("#LINK#",
bh_get_weburi()."/index.php?page=signup&confirmregid=$regid&username=$vlhq_username",
$bhlang['email:registration_validation']);
$emailaway = $emailobj->send();
if ($emailaway == false) {
@@ -101,8 +101,8 @@
$layoutobj->content1 = "
".$bhlang['error:email_error'];
$layoutobj->display();
} else {
- insert_bhdb("registrations", array("regid"=>$regid,
"username"=>$username, "password"=>md5($signup['pass1']),
"fullname"=>$signup['fullname'], "email"=>$signup['email'],
"status"=>"0", "regtime"=>time()));
- bh_log($bhlang['log:user_signed_up_'].$username, "BH_SIGNUP");
+ insert_bhdb("registrations", array("regid"=>$regid,
"username"=>$vlhq_username, "password"=>md5($signup['pass1']),
"fullname"=>$signup['fullname'], "email"=>$signup['email'],
"status"=>"0", "regtime"=>time()));
+ bh_log($bhlang['log:user_signed_up_'].$vlhq_username, "BH_SIGNUP");
# Open layout object
$layoutobj = new bhlayout("generic");
# Send the file listing to the layout, along with directory name
@@ -135,7 +135,7 @@
delete_bhdb("registrations", array("regid"=>$_GET['confirmregid'],
"username"=>$_GET['username']));
# All done. Say so.
- bh_log($bhlang['log:user_validated_'].$username,
"BH_SIGNUP_VALIDATED");
+ bh_log($bhlang['log:user_validated_'].$vlhq_username,
"BH_SIGNUP_VALIDATED");
bh_log($bhlang['notice:signup_successful_can_login'], "BH_NOTICE");
require "modules/login.inc.php";
}
@@ -165,8 +165,8 @@
update_bhdb("registrations", array("status"=>"1"),
array("regid"=>$_GET['confirmregid'], "username"=>$_GET['username']));
# All done. Say so.
- bh_log($bhlang['log:user_validated_'].$username,
"BH_SIGNUP_VALIDATED");
- bh_log($bhlang['log:user_signup_m_pending_'].$username,
"BH_SIGNUP_M_PENDING");
+ bh_log($bhlang['log:user_validated_'].$vlhq_username,
"BH_SIGNUP_VALIDATED");
+ bh_log($bhlang['log:user_signup_m_pending_'].$vlhq_username,
"BH_SIGNUP_M_PENDING");
# Open layout object
$layoutobj = new bhlayout("generic");
# Send the file listing to the layout, along with directory name
@@ -196,4 +196,4 @@
$layoutobj->content1 = "
".$bhlang['error:signup_disabled'];
$layoutobj->display();
-}
\ No newline at end of file
+}
-------------------------PATCH ENDS
HERE----------------------------------------------------------------------------