Advisory ID: HTB23175
Product: Microweber
Vendor: Microweber
Vulnerable Version(s): 0.8 and probably prior
Tested Version: 0.8
Advisory Publication: September 25, 2013 [without technical details]
Vendor Notification: September 25, 2013=20
Vendor Patch: September 26, 2013=20
Public Disclosure: October 16, 2013=20
Vulnerability Type: Improper Access Control [CWE-284]
CVE Reference: CVE-2013-5984
Risk Level: Critical=20
CVSSv2 Base Score: 10 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://w=
ww.htbridge.com/advisory/ )=20
---------------------------------------------------------------------------=
--------------------
Advisory Details:
High-Tech Bridge Security Research Lab discovered vulnerability in Microweb=
er, which can be exploited to delete arbitrary files and compromise vulnera=
ble system as a consequence.
1) Improper Access Control in Microweber: CVE-2013-5984
Vulnerability exists due to improper access restriction to "/userfiles/modu=
les/admin/backup/delete.php" script and insufficient validation of user-sup=
plied input passed via "file" HTTP GET parameter.=20
A remote unauthenticated attacker can delete arbitrary files on the target =
system with privileges of the web server using directory traversal sequence=
s and NULL byte.=20
The exploitation example below deletes the application's configuration file=
"config.php":
http://[host]/userfiles/modules/admin/backup/delete.php?file=3D../../../.=
=2E/../config.php%00
After deletion of the "config.php" file the application will suggest to re-=
install it from scratch when accessing "/index.php" file. Further exploitat=
ion of this vulnerability allows the attacker to reinstall the application =
and get full administrative access to it.=20
After successful re-installation the attacker can use "Admin Console" modul=
e of the application to execute arbitrary PHP code on the target system.=20
Simple exploit below displays output of "phpinfo()" PHP function after succ=
essful re-installation of application:
POST /module/ HTTP/1.1
module=3Dadmin%2Fconsole%2Fterm&data-type=3Dadmin%2Fconsole%2Fterm&id=3Dmw_=
exec_term_command&class=3D+module++&exec_command=3DcGhwaW5mbw=3D=3D&exec_co=
mmand_params=3DMQ%3D%3D
---------------------------------------------------------------------------=
--------------------
Solution:
Update to Microweber version 0.830
More Information:
https://github.com/microweber/microweber/commit/9177d134960c24cb642d5cf3b42=
a1fba286219cc
---------------------------------------------------------------------------=
--------------------
References:
[1] High-Tech Bridge Advisory HTB23175 - https://www.htbridge.com/advisory/=
HTB23175 - Remote Code Execution in Microweber.
[2] Microweber - http://microweber.com - Microweber is free drag and drop c=
ms and website builder.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - in=
ternational in scope and free for public use, CVE=C2=AE is a dictionary of =
publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to =
developers and security practitioners, CWE is a formal list of software wea=
kness types.
[5] ImmuniWeb=C2=AE - http://www.htbridge.com/immuniweb/ - is High-Tech Bri=
dge's proprietary web application security assessment solution with SaaS de=
livery model that combines manual and automated vulnerability testing.
---------------------------------------------------------------------------=
--------------------
Disclaimer: The information provided in this Advisory is provided "as is" a=
nd without any warranty of any kind. Details of this Advisory may be update=
d in order to provide as accurate information as possible. The latest versi=
on of the Advisory is available on web page [1] in the References.