CVE-2013-6225: Remote Code Execution in LiveZilla

Date: 2013-11-15 08:33:44

1. Introduction

2. Vulnerability Description

Inside the file ‘mobile/php/translation/index.php’ the following code can be found:

The ‘g_language’ GET parameter is not validated before using it in a php require function call. This allows to include files that are stored on a windows server. It is, in this case, not possible to include files, if the php application is running on a linux server because ‘/langmobile’+ the language is not a directory and therefore cannot be traversed. In recent PHP versions null bytes are blocked. This means that in this case only files with the PHP extension can be included. Older PHP versions will allow null bytes in the URL and therefore allow Remote Code Execution attacks involving httpd log files or /proc/pid/environ and other techniques to transform this Local File Inclusion into a full Remote Code Execution on Windows and Linux.

On Windows systems with PHP versions installed that allow null bytes in the URL it is possible to turn this local file inclusion vulnerability to a full remote code execution vulnerability. This can be done by traversing directories and accessing the apache log file with having the injected the string that follows using a GET request into the log file. As the screendump shows full code execution in this case executing calc.exe on windows is possible.

A working exploit for this vulnerability is found in the Appendix of this documents. The error.log or access.log path has to be known prior to running the exploit.

3. Proof of Concept Codes:

Code execution URL sample:

4. Solution

Download and install latest version:

http://www.livezilla.net/downloads/en/

5. Report Timeline

Download article: