Multiple vulnerabilities in Piwigo

[advisory@xxxxxxxxxxxx]

Advisory ID: HTB23085
Product: Piwigo
Vendor: Piwigo project
Vulnerable Version(s): 2.3.3 and probably prior
Tested Version: 2.3.3
Vendor Notification: 4 April 2012 
Vendor Patch: 8 April 2012 
Public Disclosure: 25 April 2012 
Vulnerability Type: Directory Path Traversal, Cross-Site Scripting (XSS) 
CVE Reference(s): CVE-2012-2208, CVE-2012-2209
Solution Status: Fixed by Vendor
Risk Level: Medium 
Credit: High-Tech Bridge SA Security Research Lab ( 
https://www.htbridge.com/advisory/ ) 

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge SA Security Research Lab has discovered multiple 
vulnerabilities in Piwigo, which can be exploited to perform Cross-Site 
Scripting (XSS) and Path Traversal attacks.


1) Directory Path Traversal in Piwigo: CVE-2012-2208

1.1 Input passed via the "language" GET parameter to upgrade.php is vulnerable 
to directory path traversal. The directory path passed to the "language" 
parameter is later used in include() function to include the following files: 
common.lang.php, admin.lang.php, install.lang.php and upgrade.lang.php. 

Under certain conditions this can be exploited to include malicious PHP file 
and execute arbitrary PHP code. To exploit this vulnerability the attacker 
should create a file with the name from the list above (for example 
admin.lang.php) in the file system (for example in /tmp/) and try to include it 
via directory traversal.

The following PoC (Proof of Concept) demonstrates the vulnerability:

http://[host]/upgrade.php?language=../../../../../tmp/

/tmp/ directory should contain "admin.lang.php" file that will be used in 
include() call.


2) Multiple Cross-Site Scripting (XSS) in Piwigo: CVE-2012-2209

2.1 Input passed via the "section" GET parameter to admin.php is not properly 
sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in 
administrator's browser session in context of affected website.

The following PoC (Proof of Concept) demonstrates the vulnerability:

http://[host]/admin.php?page=configuration&section=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

2.2 Input passed via the "installstatus" GET parameter to admin.php is not 
properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in 
administrator's browser session in context of affected website.

The following PoC demonstrates the vulnerability:

http://[host]/admin.php?page=languages_new&installstatus=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

2.3 Input passed via the "theme" GET parameter to admin.php is not properly 
sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in 
administrator's browser session in context of affected website.

The following PoC demonstrates the vulnerability:

http://[host]/admin.php?page=theme&theme=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

-----------------------------------------------------------------------------------------------

Solution:

Upgrade to Piwigo 2.3.4

More Information:
http://piwigo.org/forum/viewtopic.php?id=19173
http://piwigo.org/releases/2.3.4
http://piwigo.org/bugs/view.php?id=2607

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23085 - 
https://www.htbridge.com/advisory/HTB23085 - Multiple vulnerabilities in Piwigo.
[2] Piwigo - http://piwigo.org/ - Piwigo is a photo gallery software for the 
web, built by an active community of users and developers.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - 
international in scope and free for public use, CVE® is a dictionary of 
publicly known information security vulnerabilities and exposures.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and 
without any warranty of any kind. Details of this Advisory may be updated in 
order to provide as accurate information as possible. The latest version of the 
Advisory is available on web page [1] in the References.