Re: [FSA016] ISPConfig 2.2.3, File inclusion vulnerability

[t.brehm () ispconfig org]

Thank you for posting your ISPConfig code review.

The posted proof of concept exploit does not affect any ISPConfig installation.

Explanation:

There is one thing that you did not took in account while reviewing the sources:

You reviewed the installation tarball that is not identical with the resulting system after installtion. The file, 
where the $go_info array is declared that resulted in your errors is created by the installer. ISPCOnfig is not a web 
application that is run in a normal PHP capable webspace, ISPConfig comes with its own apache webserver and PHP 
specially compiled and configured for the needs of ISPConfig that prevents the attacks you described.


Your review in detail with the explanation why the files are not affected.

---------------------------------------------------------------
Error occured in server.inc.php, line 35:

include_once($go_info["isp"]["classes_root"] .
$go_info["server"]["dir_trenner"] ."ispconfig_template.lib.php");
---------------------------------------------------------------

- The file server.inc.php is not inside the web root in 
  any ISPConfig installation.

---------------------------------------------------------------
Error occured in app.inc.php, line 48 - 49:

$dbclass = $go_info["server"]["classes_root"] .
$go_info["server"]["dir_trenner"]
."ispconfig_db_".$go_info["server"]["db_type"].".lib.php";
include_once($dbclass);
---------------------------------------------------------------

- The file server.inc.php is not inside the web root in 
  any ISPConfig installation.
- Additionally, the file contains a check in line 31 that
  it is not executed when the file config.inc.php is not
  included, where the $go_info variables are defined.
- Register globals is off in all ISPConfig installations.

---------------------------------------------------------------
Error occured in login.php, line 30 - 31:

$dbclass = $go_info["server"]["classes_root"] .
$go_info["server"]["dir_trenner"]
."ispconfig_db_".$go_info["server"]["db_type"].".lib.php";
include_once($dbclass);
---------------------------------------------------------------

- The file with the variable declaration of the $go_info array is 
  included in line 1.
- Register globals is off in all ISPConfig installations.

---------------------------------------------------------------
Error occured in trylogin.php, line 32 - 33:

$dbclass = $go_info["server"]["classes_root"] .
$go_info["server"]["dir_trenner"]
."ispconfig_db_".$go_info["server"]["db_type"].".lib.php";
include_once($dbclass);
---------------------------------------------------------------

- The file with the variable declaration of the $go_info array is 
  included in line 29.
- Register globals is off in all ISPConfig installations.