[phpldapadmin] [ phpldapadmin-Bugs-3417184 ] PHP Code Injection Vulnerability

Bugs item #3417184, was opened at 2011-10-02 10:27
Message generated for change (Comment added) made by johnbloom
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498546&aid=3417184&group_id=61828

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
Status: Closed
Resolution: Accepted
Priority: 9
Private: No
Submitted By: EgiX ()
Assigned to: Nobody/Anonymous (nobody)
Summary: PHP Code Injection Vulnerability

Initial Comment:
Hi guys,
I've found a critical security vulnerability into /lib/functions.php
The vulnerable function is "masort", look at the code: http://phpldapadmin.git.sourceforge.net/git/gitweb.cgi?p=phpldapadmin/phpldapadmin;a=blob;f=lib/functions.php;#l1002
The $sortby parameter isn't properly sanitized before being used in a call to "create_function()" at line 1080, this can be exploited to inject and execute arbitrary PHP code.

----------------------------------------------------------------------

Comment By: John Bloom (johnbloom)
Date: 2011-10-26 12:51

Message:
There's an exploit for this in the wild:
http://dev.metasploit.com/redmine/issues/5820
I believe this exploit was used to compromise my personal server, but I
managed to mitigate it on the server at work running phpldapadmin. It might
be nice if you could at least put up an advisory.

----------------------------------------------------------------------

Comment By: Deon George (wurley)
Date: 2011-10-05 15:05

Message:
Thanks for identifying this.

A fix has been commited #76e6dad - please let me know if you dont think it
is valid.

----------------------------------------------------------------------

Comment By: EgiX ()
Date: 2011-10-05 09:13

Message:
Anyway, the fix provided by "gruberroland"  should be good.

----------------------------------------------------------------------

Comment By: EgiX ()
Date: 2011-10-05 09:12

Message:
Hi,
this is an example that proves the vulnerability I've reported:

http://localhost/phpldapadmin/htdocs/cmd.php?cmd=query_engine&query=none&search=1&orderby=foo));}}phpinfo();die;/*

When handling "query_engine" cmd, the $_REQUEST['orderby'] parameter
is the only input that is passed to $sortby param of "masort" function.

There's only another suspect call from "return_ldap_hash" function:
http://phpldapadmin.git.sourceforge.net/git/gitweb.cgi?p=phpldapadmin/phpldapadmin;a=blob;f=lib/functions.php;#l2952
But I think that this isn't exploitable.

Regards,
EgiX

----------------------------------------------------------------------

Comment By: Deon George (wurley)
Date: 2011-10-05 05:23

Message:
Can you provide a working example?

----------------------------------------------------------------------

Comment By: Roland Gruber (gruberroland)
Date: 2011-10-02 11:20

Message:
I think the whole "create_function" should be replaced with normal PHP
code. Dynamic creation of code is always a risk.
This is why I submitted a patch to remove all eval() calls.


A quick fix could look like this:

		foreach (explode(',',$sortby) as $key) {
			if (!preg_match('/^[a-zA-z0-9_]+$/', $key)) {
				die();
			}


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498546&aid=3417184&group_id=61828

------------------------------------------------------------------------------
The demand for IT networking professionals continues to grow, and the
demand for specialized networking skills is growing even more rapidly.
Take a complimentary Learning@Cisco Self-Assessment and learn 
about Cisco certifications, training, and career opportunities. 
http://p.sf.net/sfu/cisco-dev2dev
______________________________________
phpLDAPadmin development mailing list.
To unsbuscribe: https://lists.sourceforge.net/lists/listinfo/phpldapadmin-devel
http://phpldapadmin.sourceforge.net/